USN-5386-1 python-aiohttp vulnerability

Jelmer Vernooij and Beast Glatisant discovered that AIOHTTP incorrectly handled certain URLs, leading to an open redirect attack. A remote attacker could possibly use this issue to perform phishing attacks...

CVE-2022-27422

A reflected cross-site scripting XSS vulnerability in Chamilo LMS v1.11.13 allows attackers to execute arbitrary web scripts or HTML via user interaction with a crafted URL...

F-Secure SAFE 安全漏洞

F-secure F-Secure SAFE is a suite of antivirus software from the Finnish company F-secure. A security vulnerability exists in F-Secure SAFE version 8.6 and earlier versions, which stems from the browser not displaying the full URL, such as a port number. A maliciously crafted website can be used ...

Jenkins 跨站请求伪造漏洞

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins Subversion Plugin is vulnerable to cross-site request forgery, which can be exploited by an attacker to connect to ...

The vulnerability of Siemens SINEMA Remote Connect lies in the redirection of the URL to an unreliable website, allowing attackers to carry out phishing attacks.

The vulnerability of Siemens SINEMA Remote Connect relates to the redirection of the URL to an unreliable website. Exploiting this vulnerability allows a malicious actor to carry out phishing attacks using a specially created link...

The vulnerability of D-Link DIR-850 router’s microprogramming software, related to deficiencies in access control, allows a intruder to redirect a user to any arbitrary URL address.

The vulnerability of D-Link DIR-850 router microprogramming software is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to redirect users to any arbitrary URL address...

The vulnerability of D-Link DIR-850 router’s microprogramming software, related to errors during the loading of configuration files, allows a hacker to redirect users to any arbitrary URL address.

The vulnerability of D-Link DIR-850 router’s microprogramming software is related to errors during the loading of configuration files. Exploiting this vulnerability can allow a malicious actor to redirect users to any desired URL address...

GHSA-G694-M8VQ-GV9H URL Confusion When Scheme Not Supplied in medialize/uri.js

Medialize is a Javascript URL mutation library. When parsing a URL without a scheme and with excessive slashes, like ///www.example.com, URI.js will parse the hostname as null and the path as /www.example.com. Such behaviour is different from that exhibited by browsers, which will parse...

Medialize URI.js 安全漏洞

Medialize URI.js is a Javascript-based code library from the Medialize team that can be used to efficiently splice URLs. A security vulnerability exists in Medialize URI.js versions prior to 1.19.11, which stems from CRHTLF resulting in invalid protocol extraction...

PT-2022-19864

Name of the Vulnerable Software and Affected Versions ICONICS GENESIS64 versions 10.97 to 10.97.1 Description The issue allows a remote unauthenticated attacker to access arbitrary files in the GENESIS64 server and disclose information stored in the files. This is achieved by embedding a maliciou...

CVE-2022-23798

An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not...

迅易科技 74cms 安全漏洞

Xunyi Technology 74cms is a PHP and MySQL based online recruitment system from China Xunyi Technology Company. A security vulnerability exists in 74cmsSE v3.4.1, which was discovered via the $url parameter in indexcontrollerDownload.php. 74cmsSE v3.4.1 contains an arbitrary file read vulnerabilit...

openstack-nova: novnc allows open redirection

A vulnerability was found in CPython which is used by openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL...

h2: Remote Code Execution in Console

A flaw was found in h2. The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. This flaw allows an attacker to use this URL to send another server’s code, causing remote code execution. This issue is exploited...

CVE-2022-0591

The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3get AJAX action, leading to SSRF issues exploitable by unauthenticated users...

CVE-2022-25452

Tenda AC6 v15.03.05.09multi was discovered to contain a stack overflow via the URLs parameter in the saveParentControlInfo function...

CVE-2022-25433

Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the urls parameter in the saveparentcontrolinfo function...

CVE-2022-24414

Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests. These request parameters can get logged in reverse proxies and server logs. Attackers may potentially use these tokens to access CloudLink server. Tokens should not be used in request URL to avoid such attac...

Jenkins Extended Choice Parameter Plugin 权限许可和访问控制问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. Jenkins Extended Choice Parameter Plugin is vulnerable to a permission...

CLSA-2022-1647254655 Fix CVE(s): CVE-2022-0391

SECURITY UPDATE: incorrect URL parsing - debian/patches/CVE-2022-0391.patch: add stripping ASCII newline and tabs from the url by urllib.parse - CVE-2022-0391...