CVE-2024-53264 Open Redirect Vulnerability in Loading Page in bunkerweb

bunkerweb is an Open-source and next-generation Web Application Firewall WAF. A open redirect vulnerability exists in the loading endpoint, allowing attackers to redirect authenticated users to arbitrary external URLs via the "next" parameter. The loading endpoint accepts and uses an unvalidated...

BunkerWeb 输入验证错误漏洞

BunkerWeb is an open source web application firewall from Bunkerity Open Source. An input validation error vulnerability exists in BunkerWeb version 1.5.11 and earlier, which stems from the presence of an open redirection vulnerability that allows an attacker to redirect an authenticated user to ...

Taiga 安全漏洞

Taiga is a free open source project management tool from Taiga Open Source. A security vulnerability exists in Taiga version 6.8.1, which stems from the presence of an open redirection vulnerability that allows an attacker to redirect a user to an arbitrary website by appending a crafted link...

PT-2024-35776 · Taiga · Taiga

Name of the Vulnerable Software and Affected Versions: Taiga version 6.8.1 Description: The issue allows attackers to redirect users to arbitrary websites by appending a crafted link to the /login?next= parameter in the login page URL. This can potentially lead to unauthorized access...

PT-2024-17577 · Pyload · Pyload

Name of the Vulnerable Software and Affected Versions: pyload/pyload version 0.5.0 Description: An open redirection vulnerability exists due to improper handling of the next parameter in the login functionality. This allows an attacker to redirect users to malicious sites, potentially leading to...

pyLoad 输入验证错误漏洞

pyLoad is a free and open source download manager written in Python by pyLoad Open Source. An input validation error vulnerability exists in pyload version 0.5.0 due to improper handling of the "next" parameter in the login function. An attacker could use this vulnerability to redirect users to a...

aap-gateway: XSS on aap-gateway

A vulnerability was found in aap-gateway. A Cross-site Scripting XSS vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions a...

CVE-2024-10033 Aap-gateway: xss on aap-gateway

A vulnerability was found in aap-gateway. A Cross-site Scripting XSS vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions a...

AAP Gateway 跨站脚本漏洞

AAP Gateway is a prototype for a unified AAP UI and authentication by the individual developer David Newswanger. AAP Gateway suffers from a cross-site scripting vulnerability that stems from allowing a malicious user to attack via a ?next= in a URL, which could result in redirection, injection of...

PT-2024-32644 · Scout +1 · Scout +1

Name of the Vulnerable Software and Affected Versions: Scout versions prior to 4.89 Description: The issue allows for open redirect attacks, enabling phishing attacks on users by redirecting them to malicious pages. The /login API endpoint is vulnerable due to the absence of sanitization logic in...

PYSEC-2024-90

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In Indico prior to version 3.3.4, corresponding to Flask-Multipass prior to version 0.5.5, there is a Cross-Site-Scripting vulnerability during account creation when redirecting to the...

PT-2024-31603 · Unknown +1 · Flask-Multipass +1

Name of the Vulnerable Software and Affected Versions: Indico versions prior to 3.3.4 Flask-Multipass versions prior to 0.5.5 Description: There is a Cross-Site-Scripting issue during account creation when redirecting to the next URL. Exploitation requires initiating the account creation process...

The vulnerability of the Flask-Security-Too security management tool lies in the redirection of URLs to an unreliable website, allowing attackers to redirect users to arbitrary URL addresses.

The vulnerability of the Flask-Security-Too security management tool is related to the redirection of URLs to an unreliable website when the “next” request parameter is processed. Exploiting this vulnerability allows a malicious actor to redirect users to any desired URL address remotely...

SUSE CVE-2023-49438

An open redirect vulnerability in the python package Flask-Security-Too =5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes...

GHSA-672H-6X89-76M5 Open redirect vulnerability in Flask-Security-Too

An open redirect vulnerability in the python package Flask-Security-Too =2.1.0 the autocorrectlocationheader configuration was changed to False - which means that location headers in redirects are relative by default. Thus, this issue may impact applications that were previously not impacted, if...

CVE-2023-49438

An open redirect vulnerability in the python package Flask-Security-Too =5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes...

PYSEC-2023-248

An open redirect vulnerability in the python package Flask-Security-Too =5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes...

CVE-2023-49438

An open redirect vulnerability in the python package Flask-Security-Too =5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes...

Flask Middleware Flask-security Security Vulnerabilities

Flask Middleware Flask-security is a Python-based codebase from the Flask Middleware organization that provides security features for Flask applications. Flask Middleware Flask-security A security vulnerability exists in Flask-Security-Too 5.3.2 and earlier versions that originates from a...

PT-2023-8085

Name of the Vulnerable Software and Affected Versions Flask-Security-Too versions =2.1.0 may impact applications that were previously not affected, as the autocorrect location header configuration was changed to False, making location headers in redirects relative by default. Recommendations For...