CVE-2023-23855

SAP Solution Manager 720 is affected by an authenticated-user URL validation issue that enables redirection to a malicious site, potentially exposing or allowing modification of information and phishing, per CVE-2023-23855. Root cause: insufficient URL validation in the application. Public refere...

USN-5866-1 nova vulnerabilities

It was discovered that Nova did not properly manage data logged into the log file. An attacker with read access to the service's logs could exploit this issue and may obtain sensitive information. This issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. CVE-2015-9543 It was discovered that...

openSUSE 15 Security Update : python-Flask-Security (SUSE-SU-2022:3834-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2022:3834-1 advisory. - CVE-2021-23385: Fixed open redirect bsc1202105. Tenable has extracted the preceding description block directly from the SUSE security advisory. Note that...

Open Redirect

actionpack is vulnerable to Open Redirect. The vulnerability exists because the urlhostallowed function in redirecting.rb does not properly validate the URL strings, allowing an attacker to redirect the user to malicious URLs...

CVE-2022-3782

CVE-2022-3782 affects Keycloak / Red Hat Single Sign-On: path traversal via double URL encoding due to improper validation of redirect URLs, enabling an attacker to traverse to arbitrary files within the domain when wildcard Redirect URIs are used. Connected sources confirm the issue and indicate...

CVE-2022-3782

keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within t...

CVE-2020-26302

is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. is.js uses a regex copy-pasted from a gist to validate URLs. Trying to validate a malicious string can cause the regex to...

Open Redirect

djangotermsandconditions is vulnerable to open redirect. The vulnerability exists in views.py due to lack of url validations, which allows an attacker to redirect the victim to a malicious site...

Open Redirect

oils is vulnerable to open direct. The vulnerability exists in Web.js due to a lack of url validations which allows an attacker to redirect a user to an arbitrary URL...

Path Traversal

org.keycloak:keycloak-services is vulnerable to Path Traversal. The vulnerability is due to improper redirect URL validation, which lets an attacker bypass validation for redirects and access sensitive information on the domain...

Keycloak vulnerable to path traversal via double URL encoding

Keycloak does not properly validate URLs included in a redirect. An attacker could construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain, or possibly conduct further attacks...

CVE-2022-3782

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. Thi...

Browsershot does not validate URL protocols passed to Browsershot URL method

Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method...

Design/Logic Flaw

Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method...

Ondisk Player 数据伪造问题漏洞

Ondisk Player is a player from the Korean company Ondisk. A security vulnerability exists in Ondisk Player versions prior to 1.3.9.19, which stems from insufficient validation of URLs, etc. A remote attacker can exploit this vulnerability to cause malicious code to be downloaded and executed by a...

CVE-2022-41706 Browsershot 3.57.2 - Server Side XSS to LFR via URL

Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method...

Cross-Site Scripting (XSS)

Concrete CMS is vulnerable to cross-site scripting. The vulnerability exists due to lack of url validation in the state parameter which allows a remote attacker to inject and execute malicious JavaScript on the target system...

CVE-2022-41215

SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation. This could lead to the user being tricked to disclose personal information...

CVE-2022-41215

SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation. This could lead to the user being tricked to disclose personal information...

CVE-2022-41215

SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation. This could lead to the user being tricked to disclose personal information...