530 matches found
CVE-2021-29468
Cygwin Git is a patch set for the git command line tool for the cygwin environment. A specially crafted repository that contains symbolic links as well as files with backslash characters in the file name may cause just-checked out code to be executed while checking out a repository using Git on...
Code injection
Cygwin Git is a patch set for the git command line tool for the cygwin environment. A specially crafted repository that contains symbolic links as well as files with backslash characters in the file name may cause just-checked out code to be executed while checking out a repository using Git on...
CVE-2021-29468 Arbitrary code execution when checking out an attacker-controlled Git branch
Cygwin Git is a patch set for the git command line tool for the cygwin environment. A specially crafted repository that contains symbolic links as well as files with backslash characters in the file name may cause just-checked out code to be executed while checking out a repository using Git on...
CVE-2021-29468
Technical details for CVE-2021-29468 are not provided in the connected documents. Monitor for updates and new disclosures.
CVE-2021-29468
Cygwin Git is a patch set for the git command line tool for the cygwin environment. A specially crafted repository that contains symbolic links as well as files with backslash characters in the file name may cause just-checked out code to be executed while checking out a repository using Git on...
Cygwin 输入验证错误漏洞
Cygwin is an application program. DLL that provides substantial POSIX API functionality. An input validation error vulnerability exists in Cygwin Git, which stems from the fact that a specially designed repository containing symbolic links and files with backslash characters in the filename could...
CVE-2021-27516
A flaw was found in nodejs-urijs where URI.js urijs mishandles certain uses of the backslash such as http:/ and interprets the URI as a relative path. The highest threat from this vulnerability is to confidentiality...
URIjs Hostname spoofing via backslashes in URL
Impact If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a backslash \ character as part of the scheme delimiter, e.g. scheme:/\hostname. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and...
GHSA-P6J9-7XHC-RHWP URIjs Hostname spoofing via backslashes in URL
Impact If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a backslash \ character as part of the scheme delimiter, e.g. scheme:/\hostname. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and...
CVE-2021-27515
url-parse before 1.5.0 mishandles certain uses of backslash such as http:/ and interprets the URI as a relative path...
CVE-2021-27516
URI.js aka urijs before 1.19.6 mishandles certain uses of backslash such as http:/ and interprets the URI as a relative path...
CVE-2021-27516
URI.js aka urijs before 1.19.6 mishandles certain uses of backslash such as http:/ and interprets the URI as a relative path...
CVE-2021-27515
url-parse before 1.5.0 mishandles certain uses of backslash such as http:/ and interprets the URI as a relative path...
CVE-2021-27516
URI.js aka urijs before 1.19.6 mishandles certain uses of backslash such as http:/ and interprets the URI as a relative path...
CVE-2021-27516
CVE-2021-27516 affects the URI.js (urijs) library prior to v1.19.6. The issue stems from how the library handles backslashes in the URL delimiter (e.g., https:/...), which can cause hostname spoofing and misinterpretation of the target hostname, potentially enabling SSRF, open redirects, or relat...
PT-2021-17489 · Uri.Js · Uri.Js
Name of the Vulnerable Software and Affected Versions: URI.js versions prior to 1.19.6 Description: The issue concerns the mishandling of backslash characters in certain URI schemes, such as http:/, which can lead to incorrect interpretation of the URI as a relative path. This can result in...
CVE-2021-27515
url-parse before 1.5.0 mishandles certain uses of backslash such as http:/ and interprets the URI as a relative path...
CVE-2021-27515
CVE-2021-27515 affects the url-parse library (before 1.5.0), where backslash sequences in the protocol (e.g., http:/ or http:) can cause the parser to treat the URI as a relative path. Public advisories (Debian/Ubuntu) list this alongside other url-parse issues and indicate fixes via package upgr...
URI.js Security Vulnerability
Medialize URI.js is a Javascript-based code library from the Medialize team that can be used to efficiently splice URLs. A security vulnerability exists in URI.js before 1.19.6 that stems from incorrect handling of certain uses of backslashes e.g., http: / and interpreting URIs as relative paths...
