3707 matches found
CVE-2026-85230 MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection
A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a result, an authenticated user able to modify dashboard widg...
EUVD-2026-70480
DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName to bypass directory containment and access sensitive files including encrypted database credentia...
CVE-2026-85176
DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName to bypass directory containment and access sensitive files including encrypted database credentia...
CVE-2026-85176 DbGate through 7.2.6 Arbitrary File Read and Write via file:// jslid
DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName to bypass directory containment and access sensitive files including encrypted database credentia...
CVE-2026-85176 DbGate through 7.2.6 Arbitrary File Read and Write via file:// jslid
DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName to bypass directory containment and access sensitive files including encrypted database credentia...
CVE-2026-85176
DbGate through 7.2.6 is vulnerable to arbitrary file read and write via the file:// scheme. The root cause lies in the jsldata controller , which fails to properly validate jslid parameters. An attacker can exploit the getJslFileName() function to bypass directory containment, allowing authentica...
PT-2026-85035
Name of the Vulnerable Software and Affected Versions DbGate affected versions not specified Description Authenticated users can read and write arbitrary files through the file:// scheme resolution due to improper validation of the jslid parameter within the jsldata controller. By exploiting the...
CVE-2026-85176: External Control of File Name or Path
DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName to bypass directory containment and access sensitive files including encrypted database credentia...
CVE-2026-85230: Improper Neutralization of Input During Web Page Generation
A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a result, an authenticated user able to modify dashboard widg...
PT-2026-85076
A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a result, an authenticated user able to modify dashboard widg...
CVE-2026-49830 DSpace: ORE resource URI does not validate scheme for non-web resources
DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI using the OAI-ORE Harvester, the ORE Ingestion Crosswalk does not validate the URI scheme. This...
CVE-2026-49830 DSpace: ORE resource URI does not validate scheme for non-web resources
DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI using the OAI-ORE Harvester, the ORE Ingestion Crosswalk does not validate the URI scheme. This...
CVE-2026-84665
Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the javascript: scheme, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permissi...
GHSA-5JGF-P345-68V8 fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
Impact fast-uri canonicalizes a host to its ASCII form only when the input carries an explicit scheme. When resolve resolves a scheme-relative reference //host/ against a scheme-bearing base, it still emits the host verbatim even though the effective scheme is known, so re-parsing the resolved UR...
NPM: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
NPM: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references vulnerability discovered by ? in WordPress Npm fast-uri versions = 2.4.2, 2.4.5...
EUVD-2026-64758
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references...
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
Impact fast-uri canonicalizes a host to its ASCII form only when the input carries an explicit scheme. When resolve resolves a scheme-relative reference //host/ against a scheme-bearing base, it still emits the host verbatim even though the effective scheme is known, so re-parsing the resolved UR...
GHSA-JQFF-G426-HQXP fast-uri vulnerable to host confusion via percent-encoded scheme normalization
Impact fast-uri decodes percent-encoded characters in the scheme component with the legacy global unescape and serializes the result back as raw characters, without re-escaping it or validating it as a scheme. A scheme that decodes to characters outside the RFC 3986 scheme grammar can therefore...
NPM: fast-uri vulnerable to host confusion via percent-encoded scheme normalization
NPM: fast-uri vulnerable to host confusion via percent-encoded scheme normalization vulnerability discovered by ? in WordPress Npm fast-uri versions = 2.3.1, 2.4.5...