CVE-2019-18624

Opera Mini for Android allows attackers to bypass intended restrictions on .apk file download/installation via an RTLO aka Right to Left Override approach, as demonstrated by misinterpretation of malicious%E2%80%AEtxt.apk as maliciouskpa.txt. This affects 44.1.2254.142553, 44.1.2254.142659, and...

CVE-2025-14744: User Interface (UI) Misrepresentation of Critical Information

Unicode RTLO characters could allow malicious websites to spoof filenames in the downloads UI for Firefox for iOS, potentially tricking users into saving files of an unexpected file type. This vulnerability was fixed in Firefox for iOS 144.0...

PT-2025-53502

Уязвимость компонента Downloads Загрузки браузера Firefox операционных систем iOS связана с ошибками представления информации пользовательским интерфейсом при обработке символов RTLO. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, проводить спуфинг-атаки...

CVE-2025-66548

The Nextcloud Deck app allows spoofing file extensions by using RTLO characters, causing a mismatch between the displayed and actual extension. Affected versions are prior to 1.12.7, 1.14.4, and 1.15.1; fixes are in 1.12.7, 1.14.4, and 1.15.1. Exploitation details are not provided in the supplied...

PT-2025-49297

Name of the Vulnerable Software and Affected Versions Nextcloud Deck versions prior to 1.12.7 Nextcloud Deck versions prior to 1.14.4 Nextcloud Deck versions prior to 1.15.1 Description Nextcloud Deck is a kanban style organization tool for personal planning and project organization integrated wi...

CVE-2025-66548: Improper Encoding or Escaping of Output

Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1.14.4, and 1.15.1, file extension can be spoofed by using RTLO characters, tricking users into download files with a different extension th...

EUVD-2019-8348

Malware in sbrugna...

EUVD-2022-32797

Malicious code in bioql PyPI...

CVE-2022-28345

The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection. It incorrectly renders RTLO encoded URLs beginning with a non-breaking space, when there is a hash character in the URL. This technique allows a remote unauthenticated attacker to send legitimate looking links, appearing t...

AVIator - Antivirus Evasion Project

AviAtor Ported to NETCore 5 with an updated UI AV|Ator About ://name AV : AntiVirus Ator : Is a swordsman, alchemist, scientist, magician, scholar, and engineer, with the ability to sometimes produce objects out of thin air https://en.wikipedia.org/wiki/Ator About ://purpose AV|Ator is a backdoor...

CVE-2022-28345

The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection. It incorrectly renders RTLO encoded URLs beginning with a non-breaking space, when there is a hash character in the URL. This technique allows a remote unauthenticated attacker to send legitimate looking links, appearing t...

Crlf injection

The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection. It incorrectly renders RTLO encoded URLs beginning with a non-breaking space, when there is a hash character in the URL. This technique allows a remote unauthenticated attacker to send legitimate looking links, appearing t...

CVE-2022-28345

The CVE-2022-28345 issue affects the Signal iOS app prior to version 5.34, where RTLO-injected, RTLO-encoded URLs beginning with an unbroken space (in the presence of a hash segment) can be rendered to resemble legitimate sites. An unauthenticated remote attacker could exploit this to spoof links...

Signal iOS Client 注入漏洞

Signal iOS Client is a free open source messaging application from Signal Open Source. It is used for simple private communication with friends. Signal for iOS had a security vulnerability prior to version 5.34 that stemmed from allowing URI spoofing via RTLO injection. It incorrectly rendered...

CVE-2022-28345: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection. It incorrectly renders RTLO encoded URLs beginning with a non-breaking space, when there is a hash character in the URL. This technique allows a remote unauthenticated attacker to send legitimate looking links, appearing t...

CVE-2019-18624

Opera Mini for Android allows attackers to bypass intended restrictions on .apk file download/installation via an RTLO aka Right to Left Override approach, as demonstrated by misinterpretation of malicious%E2%80%AEtxt.apk as maliciouskpa.txt. This affects 44.1.2254.142553, 44.1.2254.142659, and...

Design/Logic Flaw

Opera Mini for Android allows attackers to bypass intended restrictions on .apk file download/installation via an RTLO aka Right to Left Override approach, as demonstrated by misinterpretation of malicious%E2%80%AEtxt.apk as maliciouskpa.txt. This affects 44.1.2254.142553, 44.1.2254.142659, and...

CVE-2019-18624

Opera Mini for Android is affected by a vulnerability where an RTLO (Right to Left Override) encoding trick allows bypassing restrictions on .apk downloads/installs. Reported as CVE-2019-18624, it impacts versions 44.1.2254.142553, 44.1.2254.142659, and 44.1.2254.143214. The root cause is misinte...

CVE-2019-18624

Opera Mini for Android allows attackers to bypass intended restrictions on .apk file download/installation via an RTLO aka Right to Left Override approach, as demonstrated by misinterpretation of malicious%E2%80%AEtxt.apk as maliciouskpa.txt. This affects 44.1.2254.142553, 44.1.2254.142659, and...

CVE-2019-18624: Undefined Security Weakness

Opera Mini for Android allows attackers to bypass intended restrictions on .apk file download/installation via an RTLO aka Right to Left Override approach, as demonstrated by misinterpretation of malicious%E2%80%AEtxt.apk as maliciouskpa.txt. This affects 44.1.2254.142553, 44.1.2254.142659, and...