CLSA-2022-1646665957 Fix of CVE: CVE-2022-0391

CVE-2022-0391: Add stripping ASCII newline and tabs from the url by urllib.parse...

CVE-2021-46379

DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through URL redirection to untrusted site...

CVE-2022-23397

The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent in through a URL parameter. This leads to a Reflected Cross-Site Scripting vulnerability. NOTE: the vendor disputes this because the ado.im reference has "no...

UBUNTU-CVE-2022-24723

URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse ca...

Medialize URI.js 安全漏洞

Medialize URI.js is a Javascript-based code library for efficient URL stitching from the Medialize team. correctly parsed. No details of the vulnerability are currently available...

PT-2022-10519

Name of the Vulnerable Software and Affected Versions openstack-nova affected versions not specified Description A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL. This issue is also related to...

Hicos Citizen Certificate Client-side Component 操作系统命令注入漏洞

Hicos Citizen Certificate Client-side Component is a citizen certificate client-side component. Hicos Citizen Certificate Client-side Component suffers from an operating system command injection vulnerability that originates when Hicos Citizen Certificate Client-side Component does not filter...

JetBrains TeamCity 跨站请求伪造漏洞

JetBrains TeamCity is a distributed build management and continuous integration tool from JetBrains Czech Republic. The tool provides continuous unit testing, code quality analysis, and build issue analysis reporting.A security vulnerability exists in JetBrains TeamCity, which stems from the...

UBUNTU-CVE-2022-0639

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7...

PT-2022-13320

Name of the Vulnerable Software and Affected Versions url-parse versions prior to 1.5.7 Description The issue allows for authorization bypass through a user-controlled key. A specially crafted URL with an '@' sign but empty user info and no hostname, when parsed with url-parse, will return the...

Palo Alto Networks PAN-OS 安全漏洞

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. A security vulnerability exists in the Palo Alto Networks PAN-OS software that could inadvertently allow or block more URLs than intended, and allowing more URLs than intended poses...

CVE-2021-25096

The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the URL...

Totolink X5000R 缓冲区错误漏洞

The TotoLink X5000R is a router from China's Gion Electronics TotoLink. The Totolink X5000R v9.1.0u.6118B20201102 suffers from a buffer error vulnerability that allows an attacker to cause a denial of service DoS via the url parameter...

D-Link Di-7200G 命令注入漏洞

D-Link Di-7200G is a gigabit enterprise router from D-Link, China.D-Link DI-7200GV2.E1 v21.04.09E1 is vulnerable to command injection, which can be exploited by attackers to execute arbitrary commands via the url parameter...

CVE-2022-0484

Lack of validation of URLs causes Mirantis Container Cloud Lens Extension before v3.1.1 to open external programs other than the default browser to perform sign on to a new cluster. An attacker could host a webserver which serves a malicious Mirantis Container Cloud configuration file and induce...

CVE-2022-2510

Cross-site Scripting XSS vulnerability in "Extension:ExtendedSearch" of Hallo Welt! GmbH BlueSpice allows attacker to inject arbitrary HTML XSS on page "Special:SearchCenter", using the search term in the URL...

The vulnerability of the `url::recvline` function in the `url.cpp` component of the Libproxy configuration management library involves allowing an operation’s output to be within acceptable buffer data limits. This allows a malicious actor to cause a service failure.

The vulnerability of the url::recvline function in the url.cpp component of the Libproxy configuration management library is related to incorrect handling of the absence of a new line character. Exploiting this vulnerability could allow an attacker to cause service failures...

ASUS RT-AX56U 路径遍历漏洞

ASUS RT-AX56U is a wireless router from ASUS Taiwan, China.A path traversal vulnerability exists in ASUS RT-AX56U, which stems from the insufficient filtering of special characters in URL parameters by the login function of ASUS RT-AX56U, which could be exploited by an unauthenticated LAN attacke...

The vulnerability of the Google Chrome web app installer allows a hacker to manipulate the URL input by using a specially created HTML page.

The vulnerability of the Google Chrome WebApp installer is related to errors in the implementation of security checks for standard elements. Exploiting this vulnerability allows a malicious actor to manipulate the URL input using a specially created HTML page...

Digital Bazaar Forge 输入验证错误漏洞

Digital Bazaar Forge is a native implementation of Tls in Javascript and an open source tool for writing encryption-based and web-intensive web applications from Digital Bazaar, Inc. An input validation error vulnerability exists in Digital Bazaar Forge, which stems from the product allowing URL...