Authorization

Improper authorization in the custom URL scheme handler in "Rikunabi NEXT" App for Android prior to ver. 11.5.0 allows a malicious intent to lead the vulnerable App to access an arbitrary website...

GHSA-4HMQ-GGRM-QFC6 directus vulnerable to HTML Injection in Password Reset email to custom Reset URL

Impact Instances relying on an allow-listed reset URL are vulnerable to an HTML injection attack through the use of query parameters in the reset URL. Patches The problem has been resolved and released under version 9.23.0. People relying on a custom password reset URL should upgrade to 9.23.0 or...

CVE-2022-41797

Improper authorization in handler for custom URL scheme vulnerability in Lemon8 App for Android versions prior to 3.3.5 and Lemon8 App for iOS versions prior to 3.3.5 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a...

CVE-2022-41797

The CVE-2022-41797 entry describes an improper authorization flaw in Lemon8 App’s handler for a custom URL scheme.Affected software: Lemon8 App for Android and iOS (prior to version 3.3.5).Cause: the app fails to restrict URL scheme access, enabling a remote attacker to direct a user to an arbitr...

Omise: The endpoint '/test/webhooks' is vulnerable to DNS Rebinding

Vulnerability description not provided...

MAL-2022-2285 Malicious code in custom-url (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf7b0962cf6adefb05156867fa693240c50b6165462a934cba8746791380c615 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in custom-url-moreoptions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 75a58978f52912003634e8d413ab4f0bbdb564cb67992e394ec03181bc5e11be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in custom-url (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf7b0962cf6adefb05156867fa693240c50b6165462a934cba8746791380c615 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2286 Malicious code in custom-url-moreoptions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 75a58978f52912003634e8d413ab4f0bbdb564cb67992e394ec03181bc5e11be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2287 Malicious code in custom-url-paging (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 39e397694336c75c27beb5bb64c17cb7c8cd6d0f48d05514e6c0c46bafe304f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

HC Custom WP-Admin URL <= 1.4 - Unauthenticated Secret URL Disclosure

The plugin leaks the secret login URL when sending a specific crafted request curl -sIXGET -H "Cookie: validloginslug=1" https://example.com/wp-login.php HTTP/2 302 x-redirect-by: WordPress location: secret...

Code injection

PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed depending on your rules regardless of their associated URL category. This is done by creating a custom URL category list or by using an external dynamic list EDL i...

Palo Alto Networks PAN-OS 8.1.x < 8.1.21 / 9.0.x < 9.1.12 / 9.1.x < 9.1.12 / 10.0.x < 10.0.8 / 10.1.x < 10.1.3 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 8.1.x prior to 8.1.21 or 9.0.x prior to 9.1.12 or 9.1.x prior to 9.1.12 or 10.0.x prior to 10.0.8 or 10.1.x prior to 10.1.3. It is, therefore, affected by a vulnerability. - PAN-OS software provides options to exclude specific...

CVE-2021-20873

Yappli is an application development platform which provides the function to access a requested URL using Custom URL Scheme. When Android apps are developed with Yappli versions since v7.3.6 and prior to v9.30.0, they are vulnerable to improper authorization in Custom URL Scheme handler, and may ...

CVE-2021-20873

Yappli is an application development platform which provides the function to access a requested URL using Custom URL Scheme. When Android apps are developed with Yappli versions since v7.3.6 and prior to v9.30.0, they are vulnerable to improper authorization in Custom URL Scheme handler, and may ...

Authorization

Yappli is an application development platform which provides the function to access a requested URL using Custom URL Scheme. When Android apps are developed with Yappli versions since v7.3.6 and prior to v9.30.0, they are vulnerable to improper authorization in Custom URL Scheme handler, and may ...

CVE-2021-20873

Yappli is an application development platform which provides the function to access a requested URL using Custom URL Scheme. When Android apps are developed with Yappli versions since v7.3.6 and prior to v9.30.0, they are vulnerable to improper authorization in Custom URL Scheme handler, and may ...

CVE-2021-20873

CVE-2021-20873 affects Yappli Android Apps built with Yappli versions 7.3.6 through 9.30.0. The issue is improper authorization in the Custom URL Scheme handler, which can direct the app to unintended sites via a crafted URL. Reported impact includes potential leakage or alteration of internal in...

JVN#66422035: Android Apps developed using Yappli fails to restrict custom URL schemes properly

Yappli provided by Yappli, Inc. is an application development platform. Android Apps that are developed with Yappli provide the function to access a requested URL using Custom URL Scheme. The access to the function is not restricted properly CWE-939 which may be exploited to direct the App to...

Sql injection

Apache Superset up to and including 1.3.0 when configured with ENABLETEMPLATEPROCESSING on disabled by default allowed SQL injection when a malicious authenticated user sends an http request with a custom URL...