Grafana Monitoring Access Control Bypass

The vulnerability of the Grafana monitoring and observation platform relates to bypassing a list of restrictions by using punycode encoding in the request URL. Exploiting this vulnerability allows an attacker to circumvent existing access restrictions remotely...

Path Traversal

mapshaper is vulnerable to Path Traversal. The vulnerability is caused due to not sanitizing the request URL path when a request is received. This allows an attacker to read any file in the system with privilege of the user running the mapshaper-gui...

CVE-2024-1019

ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 decodes percent-encoded characters present in request URLs before it separates the URL path component from the optional query string...

Path Traversal

@hono/node-server is vulnerable to Path Traversal. The vulnerability is due to improper url string validation in src/request.ts, allowing an attacker to use .. in the request URL to access arbitrary files on the static server...

Nextcloud Security Breach

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud that stems from improper handling of request URLs, which allows users to load unallowed application pages...

CVE-2023-5358

Improper access control in Report log filters feature in Devolutions Server 2023.2.10.0 and earlier allows attackers to retrieve logs from vaults or entries they are not allowed to access via the report request url query parameters...

Oracle Linux 7 : httpd (ELSA-2019-2343)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2343 advisory. - replace index.html with Oracles index page oracleindex.html Resolves: 1566317 - CVE-2018-1312 httpd: Weak Digest auth nonce generation in modauthdige...

CVE-2023-39951

OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. OpenTelemetry Java Instrumentation prior to version 1.28.0 contains an issue related to the instrumentation of Java applications using the AWS SDK v2 with Amazon Simple Email...

Missing Sanitization

gitLab is vulnerable to Missing Sanitization. This vulnerability exits due to the lack of validation of request URLs, allowing an attacker to include sensitive values from logged exception messages within invalid URLs, which are then logged...

DEBIAN-CVE-2023-29406

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...

AZL-79070 CVE-2023-29406 affecting package golang 1.25.7-1

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...

Denial Of Service (DoS)

Unpoly-rails is vulnerable to Denial Of Service. The vulnerability exists due to the use of the request URL as an X-Up-Location response header in requestechoheaders.rb which allows an attacker to cause an application crash through a malicious input...

Cross site request forgery (csrf)

ReadtoMyShoe, a web app that lets users upload articles and listen to them later, generates an error message containing sensitive information prior to commit 8533b01. If an error occurs when adding an article, the website shows the user an error message. If the error originates from the Google...

ReadtoMyShoe security vulnerabilities

ReadtoMyShoe is a web application used for speech-to-text conversion. A security vulnerability exists in ReadtoMyShoe that stems from a request URL containing a Google Cloud API key...

PT-2022-17591 · Unknown · Lite-Dev-Server

Name of the Vulnerable Software and Affected Versions: lite-dev-server versions all Description: The issue arises due to missing input sanitization and the employment of sandboxes to the req.url user input that is passed to the server code, leading to Directory Traversal. Recommendations: For all...

CVE-2022-24414

Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests. These request parameters can get logged in reverse proxies and server logs. Attackers may potentially use these tokens to access CloudLink server. Tokens should not be used in request URL to avoid such attac...

CVE-2022-23137

ZTE's ZXCDN product has a reflective XSS vulnerability. The attacker could modify the parameters in the content clearing request url, and when a user clicks the url, an XSS attack will be triggered...

CVE-2022-23137: Improper Neutralization of Input During Web Page Generation

ZTE's ZXCDN product has a reflective XSS vulnerability. The attacker could modify the parameters in the content clearing request url, and when a user clicks the url, an XSS attack will be triggered...

CVE-2021-43009

A Cross Site Scripting XSS vulnerability exists in OpServices OpMon through 9.11 via the search parameter in the request URL...

CVE-2021-43009: Improper Neutralization of Input During Web Page Generation

A Cross Site Scripting XSS vulnerability exists in OpServices OpMon through 9.11 via the search parameter in the request URL...