1480 matches found
CVE-2022-41215
SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation. This could lead to the user being tricked to disclose personal information...
CVE-2022-41215
CVE-2022-41215 affects SAP NetWeaver ABAP Server and ABAP Platform. The issue is an unauthenticated URL redirection caused by insufficient URL validation, potentially tricking users into disclosing personal information. The vulnerability is categorized with CVSSv3.1 base score 4.7 (Medium) and in...
DEBIAN-CVE-2022-39369
phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service CAS server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker to control the host header and use a...
phpCAS vulnerable to Service Hostname Discovery Exploitation
phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service CAS server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker to control the host header and use a...
Server side request forgery (ssrf)
The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it possible for authenticated users to ma...
PT-2024-4357
Name of the Vulnerable Software and Affected Versions PHP versions 8.1. through 8.1.28 PHP versions 8.2. through 8.2.19 PHP versions 8.3. through 8.3.7 Description A code logic error in PHP's filtering functions, such as filter var, when validating URLs with FILTER VALIDATE URL, can result in...
GHSA-CG8C-GC2J-2WF7 Flask-Security vulnerable to Open Redirect
This affects all versions of package Flask-Security. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only...
Flask-Security vulnerable to Open Redirect
This affects all versions of package Flask-Security. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only...
URL Redirection to Untrusted Site ('Open Redirect')
This affects all versions of package Flask-Security. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only...
Server-Side Request Forgery (SSRF)
labelstudio is vulnerable to server-side request forgery. The vulnerability exists in the loadtasks function in uploader.py because the library doesn't properly validate URLs in data import functionality, which allows an authenticated attacker to cause an ssrf bypass via a maliciously crafted URL...
Security Bulletin: Tivoli Federated Identity Manager and Tivoli Federated Identity Manager Business Gateway redirect to an insufficiently validated URL (CVE-2013-5431)
Abstract Under certain conditions, IBM Tivoli Federated Identity Manager TFIM/ IBM Tivoli Federated Identity Manager Business Gateway TFIMBG could send a redirect to a URL provided by an external client without performing sufficient validation of the URL Content VULNERABILITY DETAILS: CVE ID:...
jsoup may not sanitize code injection XSS attempts if SafeList.preserveRelativeLinks is enabled
jsoup may incorrectly sanitize HTML including javascript: URL expressions, which could allow cross-site scripting XSS attacks when a reader subsequently clicks that link. If the non-default SafeList.preserveRelativeLinks option is enabled, HTML including javascript: URLs that have been crafted wi...
Full Read Server-Side Request Forgery (SSRF)
Description Via the /api/upload/upload-by-url endpoint is possible to upload an image via an URL provided by the user. The function that handles this upload, doesn't verify or validate the provided URL, allowing to fetch internal services. \ \ Furthermore, after the resource is fetched, there is ...
CVE-2021-23385
This affects all versions of package Flask-Security. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only...
CVE-2021-23385 Open Redirect
This affects all versions of package Flask-Security. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only...
CVE-2021-23385
This affects all versions of package Flask-Security. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only...
py-flask-security -- user redirect to arbitrary URL vulnerability
Snyk reports: This affects all versions of package Flask-Security. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerabilit...
CVE-2022-31188 Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT)
CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a Server-side request forgery SSRF vulnerability. Validation has been added to urls used in the affected code path in version 2.0.0. Users are advised to...
