13583 matches found
CVE-2021-32503
Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious attacker could use this sensitive information’s to launch further attacks on the system...
Stripe: Bypass global deny-lists by wrapping domains using "[]" in https://github.com/stripe/smokescreen
The Smokescreen proxy is an open source project written and maintained by Stripe to restrict the URLs that internal services can connect to. The primary use case for Smokescreen is to prevent server-side request forgery SSRF attacks in which external attackers leverage the behavior of our...
CVE-2022-23798
An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not...
Design/Logic Flaw
An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not...
CVE-2022-23798 [20220306] - Core - Inadequate validation of internal URLs
An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not...
CVE-2022-28153
Jenkins SiteMonitor Plugin 0.6 and earlier does not escape URLs of sites to monitor in tooltips, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
CVE-2022-28153
Jenkins SiteMonitor Plugin 0.6 and earlier does not escape URLs of sites to monitor in tooltips, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
PT-2022-18831 · Jenkins · Jenkins Bitbucket Server Integration Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Bitbucket Server Integration Plugin versions 3.1.0 and earlier Description: The issue results from the plugin not limiting URL schemes for callback URLs on OAuth consumers, leading to a stored cross-site scripting XSS vulnerability...
Jenkins Bitbucket Server Integration Plugin 跨站脚本漏洞
Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier versions are...
PT-2022-18852 · Jenkins · Jenkins Sitemonitor Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins SiteMonitor Plugin version 0.6 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because URLs of sites to monitor in tooltips are not properly escaped, allowing attackers with...
WordPress plugin Mapping Multiple URLs Redirect Same Page 跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress plugin is a WordPress open source application plugin . A cross-site scripting vulnerability exists in WordPress...
EulerOS 2.0 SP8 : mod_auth_mellon (EulerOS-SA-2022-1354)
According to the versions of the modauthmellon package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in modauthmellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate...
North Korean state-sponsored threat actor Lazarus Group exploiting Chrome Zero-day vulnerability
THREAT LEVEL: Red. For a detailed advisory, download the pdf file here For more than a month before a fix was available, North Korean state hackers known as Lazarus group exploited a zero-day, remote code execution vulnerability CVE-2022-0609 in Google Chromes web browser. The attack mainly targe...
Google Chrome Zero-Day Bugs Exploited Weeks Ahead of Patch
North Korean threat actors exploited a remote code execution RCE zero-day vulnerability in Google’s Chrome web browser weeks before the bug was discovered and patched, according to researchers. Google Threat Analysis Group TAG discovered the flaw, tracked as CVE-2022-0609, on Feb. 10, reporting a...
Open Redirect
github.com/go-gitea/gitea is vulnerable to open redirect. The vulnerability exists in RedirectToFirst function in context.go due to the presence of backslashes in the Locations which allows an attacker to parse malicious URLs to redirect the user...
WordPress Export All URLs plugin cross-site scripting vulnerability
WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. WordPress plugin is an application plugin for WordPress. A cross-site scripting vulnerability exists in versions of the WordPress Export All URLs plugin prior to 4.2, which stems from the plugin's failu...
CVE-2021-38278
Tenda AC10-1200 v15.03.06.23EN was discovered to contain a buffer overflow via the urls parameter in the saveParentControlInfo function...
CVE-2021-38278
Tenda AC10-1200 v15.03.06.23EN was discovered to contain a buffer overflow via the urls parameter in the saveParentControlInfo function...