Astro 代码问题漏洞

Astro is a content-driven website framework developed by Astro OpenSource. Versions of Astro prior to 13.1.10 had code vulnerabilities. These vulnerabilities stemmed from the use of default redirection behavior in fetch calls, which could allow Cloudflare Workers to bypass domain whitelist checks...

EUVD-2022-5377

Malicious code in bioql PyPI...

in osticket/osticket

Description The URL parser incorrectly parses the URL given IFrame src attributes. An attacker is able to inject iframe elements linking to arbitrary domains which can be viewed by admins, bypassing the embedded domain whitelist. Proof of Concept will render malicious-server site rather than...

CVE-2018-11537

Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain whitelist filter via a crafted domain...

CVE-2018-11537: Improper Input Validation

Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain whitelist filter via a crafted domain...

PT-2013-3957

Name of the Vulnerable Software and Affected Versions Google Chrome OS versions prior to 26.0.1410.57 Description The issue is related to the improper enforcement of origin restrictions for the O3D and Google Talk plug-ins. This allows remote attackers to bypass the domain-whitelist protection...

PT-2013-3956

Name of the Vulnerable Software and Affected Versions Google Chrome OS versions prior to 26.0.1410.57 Description The issue is related to the improper enforcement of origin restrictions for the O3D and Google Talk plug-ins. This allows remote attackers to bypass the domain-whitelist protection...

CVE-2013-2834: Undefined Security Weakness

Google Chrome OS before 26.0.1410.57 does not properly enforce origin restrictions for the O3D and Google Talk plug-ins, which allows remote attackers to bypass the domain-whitelist protection mechanism via a crafted web site, a different vulnerability than CVE-2013-2835...