CVE-2023-32711 Persistent Cross-Site Scripting (XSS) through a URL Validation Bypass within a Dashboard View

In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a Splunk dashboard view lets a low-privileged user exploit a vulnerability in the Bootstrap web framework CVE-2019-8331 and build a stored cross-site scripting XSS payload...

CVE-2022-28369

CVE-2022-28369 affects Verizon 5G Home LVSKIHP InDoorUnit (IDU) firmware 3.4.66.162. The crtcmode.sh crtcrpc JSON listener’s enable_ssh sub-operation does not validate a user-supplied URL, enabling a local-network attacker to supply a malicious URL. Data from that URL is written to /usr/sbin/drop...

PYSEC-2021-337

This affects all versions of package Flask-User. When using the makesafeurl function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as /////evil.com/path or \\\evil.com/path. This vulnerability is only exploitable if an...

Open Redirect

Overview Flask-User is a Customizable User Authorization & User Management: Register, Confirm, Login, Change username/password, Forgot password and more. Affected versions of this package are vulnerable to Open Redirect. When using the makesafeurl function, it is possible to bypass URL validation...

CVE-2021-23393

This affects the package Flask-Unchained before 0.9.0. When using the the validateredirecturl function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only exploitable if an...

CVE-2021-23393 Open Redirect

This affects the package Flask-Unchained before 0.9.0. When using the the validateredirecturl function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only exploitable if an...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This...

Directory Traversal

centreon/centreon is vulnerable to directory traversal. An attacker is able to bypass URL validation and inject directory traversal characters using double single/double quotes characters and include local files outside of the root directory...

Razer US: [zvault.razerzone.com] URL validation bypass

The researcher discovered that a page on our zVault that intended to perform redirection which allowed a URL bypass due to a coding flaw. The flaw was an attempt at sanitation that could actually be leveraged to redirect to a URL string useful for phishing. He provided an analysis of the code and...