13583 matches found
Google Android Access Control Error Vulnerability (CNVD-2022-13209)
Google Android is a Linux-based open source operating system from Google, Inc. A security vulnerability exists in Google Android, which stems from allowing untrusted applications to load arbitrary URLs and local files. No details of the vulnerability are currently available...
Python urllib.parse Vulnerability (bpo-43882) - Mac OS X
Python is prone to a vulnerability urllib.parse. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python"; ifdescription...
CVE-2022-24923
Improper access control vulnerability in Samsung SearchWidget prior to versions 2.3.00.6 in China models allows untrusted applications to load arbitrary URL and local files in webview...
Improper access control
Improper access control vulnerability in Samsung SearchWidget prior to versions 2.3.00.6 in China models allows untrusted applications to load arbitrary URL and local files in webview...
CVE-2022-24923
CVE-2022-24923 affects Samsung SearchWidget prior to 2.3.00.6 on China models. Root cause: improper access control that allows untrusted applications to load arbitrary URLs and local files in a webview. Affected version range: before 2.3.00.6. Remediation: update to version 2.3.00.6 or later. Not...
GHSA-R773-PMW3-F4MR Open Redirect in koa-remove-trailing-slashes
The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::removeTrailingSlashes, as the web serve...
Open Redirect in koa-remove-trailing-slashes
The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::removeTrailingSlashes, as the web serve...
Catalyst IT Mahara 访问控制错误漏洞
Catalyst It Catalyst IT Mahara is a social networking system from Catalyst IT Catalyst It in New Zealand. The system includes a blog, resume builder, file manager, and more. A security vulnerability exists in Mahara 21.04, which stems from combinations created in groups that are not shared with...
ArangoDB 代码问题漏洞
ArangoDB is a NoSQL database system from ArangoDB GmbH. A code issue vulnerability exists in ArangoDB versions v3.7.0 through v3.9.0-alpha.1, which stems from the system having a feature that downloads Foxx services from publicly available URLs, but this feature does not enforce proper filtering ...
CVE-2021-45328
Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site 'Open Redirect' via internal URLs...
Cross-site Scripting (XSS)
karma is vulnerable to cross-site scripting. An attacker can inject and execute malicious javascript through the returnUrl parameter in the complete function of karma.js by navigating to the malicious URLs...
GitLab Enterprise Edition 和 Community Edition 输入验证错误漏洞
GitLab Enterprise Edition is a content management system, and GitLab Community Edition is a community edition of GitLab from GitLab, Inc. An input validation error vulnerability exists in GitLab Enterprise Edition and Gitlab Community Edition due to improper filtering of user-supplied data in Jir...
ROS-20220125-01
The HTTP client vulnerability for Python urllib3 is related to incorrect input validation when processing URLs with multiple "@" characters in the credentials component. Exploitation of the vulnerability could allow an attacker, remotely, cause resource exhaustion and perform a denial of service...
Cross-site Scripting (XSS)
productsatcontenttypes is vulnerable to cross-site scripting attacks. The vulnerability exists due to Improper Neutralization in the imageviewfullscreen.pt file allowing an attacker to cache poisoning and redirect URLs to untrusted sites...
Mageia: Security Advisory (MGASA-2013-0196)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
nodejs-normalize-url: ReDoS for data URLs
A flaw was found in normalize-url. Node.js has a ReDoS regular expression denial of service issue because it has exponential performance for data...
Surge in Malicious QR Codes Sparks FBI Alert
Menus, event ticket sales, quick site access — QR codes have become a common way to interact as a result of the COVID-19 pandemic. But the smart little matrix bar codes are easily tampered with and can be used to direct victims to malicious sites, the FBI warned in an alert. QR codes are the...
Design/Logic Flaw
An issue was discovered in COINS Construction Cloud 11.12. In several locations throughout the application, JavaScript code is passed as a URL parameter. Attackers can trivially alter this code to cause malicious behaviour. The application is therefore vulnerable to reflected XSS via malicious UR...
CVE-2021-45224
An issue was discovered in COINS Construction Cloud 11.12. In several locations throughout the application, JavaScript code is passed as a URL parameter. Attackers can trivially alter this code to cause malicious behaviour. The application is therefore vulnerable to reflected XSS via malicious UR...