10531 matches found
springframework: URL Parsing with Host Validation
A vulnerability was found in Spring Framework. Affected versions of this package are vulnerable to an Open Redirect when using UriComponentsBuilder to parse an externally provided URL and perform validation checks on the host of the parsed URL...
Passbolt Api Tabnabbing when opening URI with menu "Open URI in a new tab"
Description A user could create and share a resource with a malicious URI. When the victim opens with menu “Open URI in a new tab” function, the malicious page has access to the window.opener object. Impact of issue The newly opened malicious page can for example change the window.opener.location...
GHSA-QM5V-PJ64-852J Passbolt Api Tabnabbing when opening URI with menu "Open URI in a new tab"
Description A user could create and share a resource with a malicious URI. When the victim opens with menu “Open URI in a new tab” function, the malicious page has access to the window.opener object. Impact of issue The newly opened malicious page can for example change the window.opener.location...
CVE-2024-31974
The com.solarized.firedown aka Solarized FireDown Browser & Downloader application 1.0.76 for Android allows a remote attacker to execute arbitrary JavaScript code via a crafted intent. com.solarized.firedown.IntentActivity uses a WebView component to display web content and doesn't adequately...
CVE-2024-31974
The CVE-2024-31974 entry concerns com.solarized.firedown (Solarized FireDown Browser & Downloader) for Android 1.0.76. Exploitation arises because com.solarized.firedown.IntentActivity uses a WebView to display web content and does not adequately sanitize the URI or extra data passed in an intent...
Exploit for SQL Injection in Valvepress Automatic
CVE-2024-27956-RCE File Package Contents: 1. exploit.py...
[SECURITY] Fedora 39 Update: uriparser-0.9.8-1.fc39
Uriparser is a strictly RFC 3986 compliant URI parsing library written in C. uriparser is cross-platform, fast, supports Unicode and is licensed under the New BSD license...
RHEL 7 : lynx (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - lynx: Invalid URL parsing of pages containing '?' CVE-2016-9179 - lynx: Use after free in...
RHEL 6 : decode-uri-component (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - decode-uri-component: improper input validation resulting in DoS CVE-2022-38900 Note that Nessus has not tested for...
OESA-2024-1534 uriparser security update
The package is a strictly RFC 3986 compliant URI parsing library written in C89"ANSI C". uriparser is cross-platform, fast, supports Unicode and is licensed under the New BSD license. There are a number of applications, libraries and hardware using uriparser, as well as bindings and 3rd-party...
CVE-2024-26026
An SQL injection vulnerability exists in the BIG-IP Next Central Manager API URI. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
CVE-2024-21793
An OData injection vulnerability exists in the BIG-IP Next Central Manager API URI. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
K000138733: BIG-IP Next Central Manager SQL Injection vulnerability CVE-2024-26026
Security Advisory Description An SQL injection vulnerability exists in the BIG-IP Next Central Manager API URI. CVE-2024-26026 Impact An unauthenticated attacker can exploit this vulnerability to execute malicious SQL statements through the BIG-IP Next Central Manager API URI. This vulnerability...
Sensitive Information Disclosure
topthink/framework is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper handling of error messages, which can reveal the PHPSESSION cookie through debug error output source code when a crafted URI is used in a GET request...
GHSA-969F-V7JV-PGJ3 ThinkPHP Cross-Site Scripting Vulnerability
ThinkPHP 8.0.3 allows remote attackers to exploit XSS due to inadequate filtering of function argument values in thinkexception.tpl...
CVE-2024-34467
ThinkPHP 8.0.3 allows remote attackers to exploit XSS due to inadequate filtering of function argument values in thinkexception.tpl...
SUSE CVE-2024-34402
An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer overflow...
CVE-2024-34467
ThinkPHP 8.0.3 is affected by a cross‑site scripting (XSS) flaw caused by inadequate filtering of function argument values in think_exception.tpl. Remote attackers may exploit this to inject scripts; several sources also describe potential disclosure of the PHPSESSION cookie via error output. Red...
