1E Platform 安全漏洞

1E Platform is a terminal endpoint management and automation solution from 1E. A security vulnerability exists in versions prior to 1E Platform 23 that stems from an identity server that can enable URL redirection to untrusted sites...

The vulnerability of Brother HL-L2360D, DCP-1610W, DCP-L2550DW, HL-L2390DW, HL-L2395DW, MFC-J4620DW, MFC-J6945DW, MFC-L2710DN, MFC-L2710DW, MFC-L2770DW, MFC-L8690CDW, TD-2130N printers’ microprogramming software allows a hacker to redirect users to any desired URL address.

The vulnerability of Brother HL-L2360D, DCP-1610W, DCP-L2550DW, HL-L2390DW, HL-L2395DW, MFC-J4620DW, MFC-J6945DW, MFC-L2710DN, MFC-L2710DW, MFC-L2770DW, MFC-L8690CDW, and TD-2130N printers relates to the redirection of URLs to unreliable websites. Exploiting this vulnerability allows a malicious...

httpd: Improper escaping of output in mod_rewrite

A flaw was found in the modrewrite module of httpd. Improper escaping of output allows an attacker to map URLs to filesystem locations permitted to be served by the server but are not intentionally or directly reachable by any URL. This issue results in code execution or source code disclosure...

go-retryablehttp: url might write sensitive information to log file

A vulnerability was found in go-retryablehttp. The package may suffer from a lack of input sanitization by not cleaning up URL data when writing to the logs. This issue could expose sensitive authentication information...

The vulnerability of the GLPI system’s handling of requests and incidents, related to the possibility of falsifying requests on the server side, allows a perpetrator to redirect users to any arbitrary URL address.

The vulnerability in the GLPI system for handling requests and incidents is related to the possibility of forged requests on the server side. Exploiting this vulnerability allows a malicious actor to redirect users to an arbitrary URL address...

httpd: Improper escaping of output in mod_rewrite

A flaw was found in the modrewrite module of httpd. Improper escaping of output allows an attacker to map URLs to filesystem locations permitted to be served by the server but are not intentionally or directly reachable by any URL. This issue results in code execution or source code disclosure...

DotCMS 安全漏洞

DotCMS is an open source content management system written in Java by DotCMS, Inc. for managing content and content-driven sites and applications. A security vulnerability exists in DotCMS that originates from a URL parameter in the login page for resetting a password that can inject HTML code...

httpd: Improper escaping of output in mod_rewrite

A flaw was found in the modrewrite module of httpd. Improper escaping of output allows an attacker to map URLs to filesystem locations permitted to be served by the server but are not intentionally or directly reachable by any URL. This issue results in code execution or source code disclosure...

Medium: wget

Issue Overview: url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent. CVE-2024-38428 Affected...

WordPress Schema & Structured Data for WP & AMP plugin <= 1.33 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via url Attribute vulnerability discovered by wesley wcraft in WordPress Plugin Schema & Structured Data for WP & AMP versions = 1.33...

Directus Security Vulnerabilities

Directus is a real-time Api and application dashboard. It is used to manage Sql database content. A security vulnerability exists in Directus versions prior to 10.9.3, which stems from allowing redirection when importing files from a URL and not checking the URL...

PT-2024-40055 · Phantomjs +2 · Phantomjs +2

Name of the Vulnerable Software and Affected Versions: yt-dlp versions prior to 2024.07.07 Description: The issue arises from yt-dlp's DouyuTV and DouyuShow extractors using a URL from cdn.bootcdn.net as a fallback for fetching a component of the crypto-js JavaScript library. This URL is owned by...

Discourse Security Breach

Discourse is an open source community discussion platform from Discourse Open Source. The platform includes community, email, and chat room features. A security vulnerability exists in Discourse that stems from the presence of stored cross-site scripting that allows an attacker to execute arbitra...

PT-2024-26391 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.2.3 on the stable branch Discourse versions prior to 3.3.0.beta3 on the tests-passed branch Description: The issue affects Discourse, an open-source discussion platform, where Oneboxing against a carefully crafte...

ALPINE-CVE-2024-38475

Improper escaping of output in modrewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure...

CVE-2023-50954

IBM InfoSphere Information Server 11.7 returns sensitive information in URL information that could be used in further attacks against the system. IBM X-Force ID: 275776...

Filter bypass in filter_var (FILTER_VALIDATE_URL)

...

CLSA-2024-1718789388 Fix CVE(s): CVE-2024-5458

SECURITY UPDATE: filter bypass in filtervar FILTERVALIDATEURL - debian/patches/CVE-2024-5458.patch: Fix validation of ipv6 hostname to check all conditions and extract condition to separate function - CVE-2024-5458...

The vulnerability of D-Link’s wireless router microprogramming software lies in the presence of undocumented configuration commands. This allows a hacker to enable the Telnet service by accessing a specially crafted URL address and logging into the system using the built-in credentials.

The vulnerability of D-Link wireless router microprogramming software is related to the presence of undocumented configuration commands. Exploiting this vulnerability allows a malicious actor to enable the Telnet service by accessing a specially crafted URL address, and then gain access to the...

D-Link E Series Security Vulnerability

D-Link E Series is a series of wireless routers from China-based AUO D-Link. A security vulnerability exists in D-Link E Series. An attacker exploiting this vulnerability could force the device to enable Telnet service by accessing a specific URL and logging in using the obtained administrator...