Remote code execution

The Zoom Client for Meetings for Android, iOS, Linux, macOS, and Windows before version 5.11.0 are susceptible to a URL parsing vulnerability. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to an arbitrary network address, leading to additional attack...

CVE-2022-28755

Zoom Client for Meetings (Android, iOS, Linux, macOS, Windows) prior to version 5.11.0 is affected by a URL parsing vulnerability. A malicious Zoom meeting URL can direct the user to an arbitrary network address, enabling potential remote code execution by launching executables from arbitrary pat...

CVE-2022-28755 Improper URL parsing in Zoom Clients

The Zoom Client for Meetings for Android, iOS, Linux, macOS, and Windows before version 5.11.0 are susceptible to a URL parsing vulnerability. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to an arbitrary network address, leading to additional attack...

PT-2022-5831 · Zoom · Zoom Client For Meetings +1

Name of the Vulnerable Software and Affected Versions: Zoom Client for Meetings versions prior to 5.11.0 Description: The issue is related to a URL parsing problem. If a malicious Zoom meeting URL is opened, it may direct the user to connect to an arbitrary network address, potentially leading to...

CVE-2022-28755

The Zoom Client for Meetings for Android, iOS, Linux, macOS, and Windows before version 5.11.0 are susceptible to a URL parsing vulnerability. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to an arbitrary network address, leading to additional attack...

New 'ParseThru' Parameter Smuggling Vulnerability Affects Golang-based Applications

Security researchers have discovered a new vulnerability called ParseThru affecting Golang-based applications that could be abused to gain unauthorized access to cloud-based applications. "The newly discovered vulnerability allows a threat actor to bypass validations under certain conditions, as ...

PT-2022-25412 · Mozilla +4 · Thunderbird +4

Name of the Vulnerable Software and Affected Versions: xdg-mail affected versions not specified Description: The issue arises when xdg-mail is configured to use thunderbird for mailto URLs, leading to improper parsing of the URL. This can result in additional headers being passed to thunderbird...

The vulnerabilities of the microprogramming software for the OPC UA Modicon Communication Module (BMENUA0100) and the X80 advanced RTU Communication Module (BMENOR2200H) allow attackers to cause service interruptions.

The vulnerability of the microprogramming software for the OPC UA Modicon Communication Module BMENUA0100 and the X80 advanced RTU Communication Module BMENOR2200H lies in the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow an attacker to cause servic...

CVE-2022-34764

A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause denial of service when parsing the URL. Affected Products: X80 advanced RTU Communication Module BMENOR2200H V1.0, OPC UA Modicon Communication Module BMENUA0100 V1.10 and prio...

多款Schneider Electric产品缓冲区错误漏洞

The Schneider Electric OPC UA Modicon Communication Module and the Schneider Electric X80 advanced RTU Communication Module are both products of the French company Schneider Electric. The Schneider Electric OPC UA Modicon Communication Module is an Ethernet communication module with an embedded O...

GO-2022-0211 Incorrect parsing validation in net/url

The url.Parse function accepts URLs with malformed hosts, such that the Host field can have arbitrary suffixes that appear in neither Hostname nor Port, allowing authorization bypasses in certain applications...

@candlelabs/sdk (>=1.0.1, <=1.0.2), candlelabssdk (1.0.0) potentially affected by CVE-2022-2217 via parse-url (6.0.0)

parse-url NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on parse-url and may be impacted: - @candlelabs/sdk =1.0.1, =1.0.2 - candlelabssdk 1.0.0 Source cves: CVE-2022-2217 Source advisory: OSV:GHSA-Q6WQ-5P59-983W...

Cross Site Scripting via Improper Input Validation

Description The parse-url The 5.0.8 version of the parser does not check :// character between protocols. This causes spoofing of the javascript protocol itself. Additionally, protocol spoofing does not occur in url-parse, new URL, and url.parse other than parse-url. Proof of Concept const parseU...

Python -- multiple vulnerabilities

Python reports: gh-103142: The version of OpenSSL used in Windows and Mac installers has been upgraded to 1.1.1u to address CVE-2023-2650, CVE-2023-0465, CVE-2023-0466, CVE-2023-0464, as well as CVE-2023-0286, CVE-2022-4303, and CVE-2022-4303 fixed previously in 1.1.1t gh-101727. gh-102153:...

CLSA-2022-1654010877 Fixed CVEs in python3: CVE-2022-0391, CVE-2021-4189, CVE-2021-3737

CVE-2021-3737: urllib: HTTP client possible infinite loop on a 100 Continue response rhbz2036020 - CVE-2021-4189: ftplib should not use the host from the PASV response rhbz2036020 - CVE-2022-0391: urllib.parse does not sanitize URLs containing ASCII newline and tabs rhbz2047376...

GHSA-X5QJ-9VMX-7G6G Improper Input Validation in .Net Framework API's

A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability'...

Improper Input Validation in .Net Framework API's

A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability'...

Fedora 36 : curl (2022-d15a736748)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-d15a736748 advisory. - fix too eager reuse of TLS and SSH connections CVE-2022-27782 - do not accept cookies for TLD with trailing dot CVE-2022-27779 - hsts: ignore...

USN-5412-1 curl vulnerabilities

Axel Chong discovered that curl incorrectly handled percent-encoded URL separators. A remote attacker could possibly use this issue to trick curl into using the wrong URL and bypass certain checks or filters. This issue only affected Ubuntu 22.04 LTS. CVE-2022-27780 Florian Kohnhuser discovered...

CVE-2022-27780

A vulnerability was found in curl. This issue occurs because the curl URL parser wrongly accepts percent-encoded URL separators like '/' when decoding the hostname part of a URL, making it a different URL using the wrong hostname when it is later retrieved. This flaw allows a malicious actor to...