Command injection

The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized...

CVE-2022-25765 Command Injection

The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized...

CVE-2022-25765

CVE-2022-25765 affects pdfkit (Ruby gem) with command injection in which pdfkit passes the user-supplied URL straight to wkhtmltopdf, allowing shell interpretation via backticks. Exploitation details show RCE via crafted URLs (e.g., http://example.comcmd), with multiple public PoCs/exploits and a...

PT-2022-13961 · Unknown +1 · Krakend-Ce +2

Name of the Vulnerable Software and Affected Versions: Lura versions prior to 2.0.2 KrakenD-CE versions prior to 2.0.2 KrakenD-EE versions prior to 2.0.0 Description: The issue arises from incorrect sanitization of URL parameters, allowing malicious users to alter the backend URL defined for a pi...

CVE-2022-2030

A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI programs of Zyxel USG FLEX 100W firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 throu...

CVE-2022-2030

A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI programs of Zyxel USG FLEX 100W firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 throu...

CLSA-2022-1654526367 Fixed CVEs in python-setuptools_scm-6.module_el8.5.0+2050+77770ab7: CVE-2021-4189, CVE-2022-0391, CVE-2021-3733, CVE-2021-3737

CVE-2021-3733: urllib: Regular expression DoS in AbstractBasicAuthHandler rhbz2047376 - CVE-2021-3737: urllib: HTTP client possible infinite loop on a 100 Continue response rhbz2047376 - CVE-2021-4189: ftplib should not use the host from the PASV response rhbz2047376 - CVE-2022-0391: urllib.parse...

CLSA-2022-1653920195 Fixed CVEs in python3: CVE-2021-3737, CVE-2021-3426, CVE-2021-4189, CVE-2022-0391

CVE-2021-3426: Remove the pydoc getfile feature which could lead to information disclosure rhbz1935913 - CVE-2021-3737: urllib: HTTP client possible infinite loop on a 100 Continue response rhbz2036020 - CVE-2021-4189: ftplib should not use the host from the PASV response rhbz2036020 -...

GHSA-H3CQ-J957-VHXG Cross-site Scripting in fullpage.js

using fullpage.js you can create a anchor tag . But when put href in anchor then it does not sanitize the url which allow for a break in the context of anchor element and can add our new element...

CVE-2022-1157

GitLab CE/EE is affected by CVE-2022-1157 due to missing sanitization of logged exception messages. The issue affects all versions prior to 14.7.7, with 14.8 prior to 14.8.5 and 14.9 prior to 14.9.2. As described in the CVE entries, this vulnerability may allow sensitive values to be logged in in...

OPENSUSE-SU-2022:1091-1 Security update for python

This update for python fixes the following issues: - CVE-2022-0391: Fixed URL sanitization containing ASCII newline and tabs in urlparse bsc1195396. - CVE-2021-4189: Fixed ftplib not to trust the PASV response bsc1194146. - CVE-2021-3572: Fixed an improper handling of unicode characters in pip...

SUSE-SU-2022:1091-1 Security update for python

This update for python fixes the following issues: - CVE-2022-0391: Fixed URL sanitization containing ASCII newline and tabs in urlparse bsc1195396. - CVE-2021-4189: Fixed ftplib not to trust the PASV response bsc1194146. - CVE-2021-3572: Fixed an improper handling of unicode characters in pip...

Security update for python (moderate)

openSUSE Security Update: Security update for python Announcement ID: openSUSE-SU-2022:1091-1 Rating: moderate References: 1175619 1186819 1194146 1195396 Cross-References: CVE-2021-3572 CVE-2021-4189 CVE-2022-0391 CVSS scores: CVE-2021-3572 SUSE: 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N...

SUSE-SU-2022:0882-1 Security update for python3

This update for python3 fixes the following issues: - CVE-2021-4189: Fixed default access from PASV response in the FTP client bsc1194146. - CVE-2022-0391: Fixed sanitizing of URLs containing ASCII newline and tabs in urlparse bsc1195396...

Remote Code Execution (RCE)

thunderbird and firefox are vulnerable remote code execution. The vulnerability exists due to a lack of sanitization of supplied parameter URL containing spaces...

CVE-2021-43530

A Universal XSS vulnerability was present in Firefox for Android resulting from improper sanitization when processing a URL scanned from a QR code. This bug only affects Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox 94...

CVE-2021-43530

Affected software: Firefox for Android. The CVE-2021-43530 entry describes a Universal XSS vulnerability caused by improper sanitization when processing a URL scanned from a QR code, affecting Firefox versions before 94. The condition is explicit in multiple sources (NVD/Nessus aggregation and re...

CVE-2021-34254

Umbraco CMS before 7.15.7 is vulnerable to Open Redirection due to insufficient url sanitization on booting.aspx...

Open redirect

Umbraco CMS before 7.15.7 is vulnerable to Open Redirection due to insufficient url sanitization on booting.aspx...

Cross-Site Scripting (XSS)

tinymce is vulnerable to cross-site scripting XSS. A vulnerability in the URL sanitization logic of the core parser for form elements allows arbitrary JavaScript execution when inserting malicious content into the editor using the clipboard or APIs, and then submitting the form...