nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service

A flaw was found in Node.js that allows a denial of service attack through resource exhaustion when using the fetch function to retrieve content from an untrusted URL. The vulnerability stems from the fetch function in Node.js that always decodes Brotli, making it possible for an attacker to caus...

ALPINE-CVE-2024-6345

A vulnerability in the packageindex module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code...

rubygem-uri: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755

A flaw was found in the rubygem URI. The URI parser mishandles invalid URLs that have specific characters, which causes an increase in execution time parsing strings to URI objects. This issue may result in a regular expression denial of service ReDoS...

Apache HTTP Server 安全漏洞

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. A security vulnerability exists in Apache HTTP Server that can be exploited by an attacker to map URLs to file system locations th...

Apache HTTP Server 输入验证错误漏洞

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. An input validation error vulnerability exists in Apache HTTP Server, which can be exploited by an attacker to cause insecure...

The vulnerability of the `filter_var` function in the PHP programming language allows attackers to replace URLs with erroneous data.

The vulnerability of the filtervar function in the PHP programming language is related to insufficient validation of data authenticity. Exploiting this vulnerability could allow an attacker to substitute URLs with erroneous data remotely...

The vulnerability of the Svacer SAST application, a static analyzer for Svace, arises from the unsafe processing of parameters during the creation of short links. This allows attackers to redirect users to any arbitrary URL address.

The vulnerability of the Svacer SAST static analyzer app is related to the unsafe processing of parameters during the creation of short links. Exploiting this vulnerability could allow a malicious actor to redirect users to any arbitrary URL address...

The vulnerability of Firefox browser for iOS, related to insufficient validation of input data, allows attackers to bypass security restrictions and load arbitrary pages.

The vulnerability of Firefox browser for iOS is related to insufficient validation of input data when URLs are copied into the address bar. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and load arbitrary pages...

nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service

A flaw was found in Node.js that allows a denial of service attack through resource exhaustion when using the fetch function to retrieve content from an untrusted URL. The vulnerability stems from the fetch function in Node.js that always decodes Brotli, making it possible for an attacker to caus...

WordPress plugin Bannerlid 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

keycloak: path transversal in redirection validation

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects a...

UBUNTU-CVE-2024-22262

Applications that use UriComponentsBuilder to parse an externally provided URL e.g. through a query parameter AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is...

CVE-2024-31393

Dragging Javascript URLs to the address bar could cause them to be loaded, bypassing restrictions and security protections This vulnerability affects Firefox for iOS 124...

Tenda FH1203 saveParentControlInfo method urls parameter buffer overflow vulnerability

Tenda FH1203 is a dual-band wireless router from Tenda China, mainly used for home network coverage. The Tenda FH1203 suffers from a buffer overflow vulnerability that originates from the urls parameter of the saveParentControlInfo method failing to properly validate the length and size of the...

The vulnerability of the saveParentControlInfo() function (/goform/saveParentControlInfo) in the Tenda AC15 router software allows a attacker to execute arbitrary code or cause a service failure.

The vulnerability of the saveParentControlInfo function /goform/saveParentControlInfo of the Tenda AC15 router’s microprogramming software is related to the issue of the operation being executed outside the buffer in memory when processing the urls parameter. Exploiting this vulnerability could...

Express.js 安全漏洞

Express.js is Express.js open source a fast, unconstrained, minimalist web framework for Node.js. A security vulnerability exists in Express.js versions prior to 4.19.0, 5.0, which stems from allowing open redirects with malformed URLs...

rubygem-uri: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755

A flaw was found in the rubygem URI. The URI parser mishandles invalid URLs that have specific characters, which causes an increase in execution time parsing strings to URI objects. This issue may result in a regular expression denial of service ReDoS...

AZL-35911 CVE-2024-22025 affecting package nodejs18 for versions less than 18.18.2-5

A vulnerability in Node.js has been identified, allowing for a Denial of Service DoS attack through resource exhaustion when using the fetch function to retrieve content from an untrusted URL. The vulnerability stems from the fact that the fetch function in Node.js always decodes Brotli, making i...

The vulnerability of the HikCentral Professional security management system, related to access control deficiencies, allows a perpetrator to gain unauthorized access to URLs.

The vulnerability of the HikCentral Professional security management system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to certain URL addresses...

DEBIAN-CVE-2024-28184

WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if urlfetcher is configured to prevent access to files and URLs. This vulnerability has been patched in...