Server-side Request Forgery (SSRF)

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the injection of arbitrary URLs. An admin-privilege authenticated attacker can force the application to make...

python: urllib.parse url blocklisting bypass

A flaw was found in the Python package. An issue in the urllib.parse component could allow attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.This may lead to compromised Integrity...

Harbinger Offline Player 路径遍历漏洞

Harbinger Offline Player is Harbinger's seamless and highly secure way to access training content without the need for a constant Internet connection. A security vulnerability exists in Harbinger Offline Player version 4.0.6.0.2, which stems from OfflinePlayerService.exe allowing directory...

WordPress plugin Orbit Fox by ThemeIsle 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability previously exist...

golang: path/filepath: path-filepath filepath.Clean path traversal

A flaw was found in Go, where it could allow a remote attacker to traverse directories on the system, caused by improper validation of user requests by the filepath.Clean on Windows package. This flaw allows an attacker to send a specially-crafted URL request containing "dot dot" sequences /../ t...

giturlparse 安全漏洞

giturlparse is a simple GIT URL parser similar to giturlparse.py. A security vulnerability exists in giturlparse prior to version 1.2.2, which stems from vulnerability to ReDoS attacks when parsing untrusted URLs...

PT-2023-24006

Name of the Vulnerable Software and Affected Versions giturlparse versions through 1.2.2 Semgrep versions 1.5.2 through 1.24.1 Description The issue is related to ReDoS Regular Expression Denial of Service when parsing untrusted URLs. This might be relevant if Semgrep is analyzing an untrusted...

python-django: Potential denial-of-service vulnerability in internationalized URLs

A denial of service flaw was discovered in Django. This issue occurs when incorrectly handling certain internationalized URLs. A malicious attacker could use this issue to cause a crash, resulting in a denial of service...

DEBIAN-CVE-2023-28756

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2...

UBUNTU-CVE-2023-28756

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2...

Ruby 安全漏洞

Ruby is a cross-platform, object-oriented, dynamically-typed programming language from the individual developer, Yukihiro Matsumoto. A security vulnerability exists in Ruby versions 0.2.1 through 3.2.1, which stems from the time parser incorrectly handling invalid URLs with certain characters...

The vulnerability of Adobe Experience Manager’s content and media data management system, related to the redirection of URLs to unreliable websites, allows attackers to circumvent security restrictions.

The vulnerability of the Adobe Experience Manager content and media data management system lies in the redirection of URLs to an unreliable website. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions remotely...

Akuvox E11 访问控制错误漏洞

Akuvox E11 is a SIP visual doorbell from Akuvox designed for villas, houses and apartments. The Akuvox E11 suffers from an Access Control Error vulnerability that originates from accessing the Akuvox E11 web server without any user authentication, which could allow an attacker to access sensitive...

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.

...

SUSE CVE-2023-23914

A cleartext transmission of sensitive information vulnerability exists in curl v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is...

SUSE CVE-2004-0989

Multiple buffer overflows in libXML 2.6.12 and 2.6.13 libxml2, and possibly other versions, may allow remote attackers to execute arbitrary code via 1 a long FTP URL that is not properly handled by the xmlNanoFTPScanURL function, 2 a long proxy URL containing FTP data that is not properly handled...

SUSE CVE-2007-0451

Apache SpamAssassin before 3.1.8 allows remote attackers to cause a denial of service via long URLs in malformed HTML, which triggers "massive memory usage."...

SUSE CVE-2008-5508

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not properly parse URLs with leading whitespace or control characters, which might allow remote attackers to misrepresent URLs and simplify phishing attacks...

SUSE CVE-2014-0480

The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // slash slash in a URL, which triggers a scheme-relative URL...

SUSE CVE-2015-7190

The Search feature in Mozilla Firefox before 42.0 on Android through 4.4 supports search-engine URL registration through an intent and can access this URL in a privileged context in conjunction with the crash reporter, which allows attackers to read log files and visit file: URLs of HTML document...