CVE-2024-34405

The CVE-2024-34405 entry concerns McAfee Security: Antivirus VPN for Android prior to version 8.3.0. The issue is described as improper deep link validation, which could allow an attacker to launch an arbitrary URL from within the app. The RedHat/CNNVD/CVE ecosystem sources corroborate the genera...

CVE-2024-31988

CVE-2024-31988 affects XWiki Platform where the realtime editor can lead to arbitrary remote code execution when an admin with programming rights visits a crafted URL or views an image containing that URL (e.g., in a comment). Affected versions are 13.9-rc-1 and earlier, specifically before 14.10...

ROS-20240408-17

Vulnerability in Flask-Security-Too security management tool is related to URL redirection to an untrusted site when processing the "next" request parameter. to an untrusted site when processing the "next" request parameter. Exploitation of the vulnerability could allow an attacker acting remotel...

PT-2024-23299 · Livemarks · Livemarks

Name of the Vulnerable Software and Affected Versions: Livemarks versions prior to 3.7 Description: The issue allows a malicious website to coerce the extension into sending an authenticated GET request to an arbitrary URL, potentially leading to Privilege Escalation. This occurs because the...

tomcat: Open Redirect vulnerability in FORM authentication

A flaw was found in Apache Tomcat if the default web application is configured with FormAuthenticator. This issue allows a specially crafted URL to trigger a redirect to an arbitrary URL...

CVE-2024-28745

Improper export of Android application components issue exists in 'ABEMA' App for Android prior to 10.65.0 allowing another app installed on the user's device to access an arbitrary URL on 'ABEMA' App for Android via Intent. If this vulnerability is exploited, an arbitrary website may be displaye...

PT-2024-22554 · Unknown · Abema App For Android

Name of the Vulnerable Software and Affected Versions: ABEMA App for Android versions prior to 10.65.0 Description: The issue exists due to the improper export of Android application components, allowing another app installed on the user's device to access an arbitrary URL on the ABEMA App for...

"ABEMA" App for Android fails to restrict access permissions

Overview "ABEMA" App for Android provided by AbemaTV, Inc. fails to restrict access permissions CWE-926 that allows another app installed on the user's device to access an arbitrary URL on "ABEMA" App via Intent. Shiga Takuma of BroadBand Security, Inc. reported this vulnerability to IPA. JPCERT/...

VulnCheck KEV: CVE-2020-13379

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network...

BIT-OPENFIRE-2020-24601

In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulnerability allows an attacker to execute an arbitrary malicious URL via the vulnerable POST parameter searchName", "alias" in the import certificate trusted page...

Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE

Summary A lack of sanitization/check in the font path returned by php-svg-lib, in the case of a inline CSS font defined, that will be used by Cpdf to open a font will be passed to a fileexists call, which is sufficient to trigger metadata unserializing on a PHAR file, through the phar:// URL...

Design/Logic Flaw

HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 service pack 3, 7.2 fix pack 15 through 18, and older unsupported versions can be circumvented by using two forward slashes, which allows remote attackers to...

tomcat: Open Redirect vulnerability in FORM authentication

A flaw was found in Apache Tomcat if the default web application is configured with FormAuthenticator. This issue allows a specially crafted URL to trigger a redirect to an arbitrary URL...

The vulnerability of the software for creating and using the Nextcloud Server’s data storage solution lies in its use of open redirection, which allows a hacker to redirect users to any arbitrary URL address.

The vulnerability of cloud software for creating and using Nextcloud Server storage relates to the use of open redirection. Exploiting this vulnerability could allow a malicious actor to redirect users to an arbitrary URL address...

The vulnerability of the authelia-bhf package for the operating system on industrial personal computers like TwinCAT/BSD, which allows a hacker to redirect users to arbitrary websites.

The vulnerability of the authelia-bhf package for the TwinCAT/BSD operating system relates to the ability to redirect users to untrusted URLs. Exploiting this vulnerability allows a malicious actor to redirect users to arbitrary websites by sending a specially crafted HTTP request...

CVE-2023-47619

Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, users with the update permission are able to read arbitrary files, delete arbitrary files and send a GET request to arbitrary URLs and read the response. This issue may lead to Information Disclosure. As of...

CVE-2023-6542 Improper Export of Android Application Components in SAP EMARSYS SDK ANDROID

Due to lack of proper authorization checks in Emarsys SDK for Android, an attacker can call a particular activity and can forward himself web pages and/or deep links without any validation directly from the host application. On successful attack, an attacker could navigate to arbitrary URL...

tomcat: Open Redirect vulnerability in FORM authentication

A flaw was found in Apache Tomcat if the default web application is configured with FormAuthenticator. This issue allows a specially crafted URL to trigger a redirect to an arbitrary URL...

Updated thunderbird packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Queued up rendering could have allowed websites to clickjack. CVE-2023-5721 Address bar spoofing via bidirectional characters. CVE-2023-5732 Large WebGL draw could have led to a crash. CVE-2023-5724 WebExtensions could open arbitrary URLs...

WPB Show Core <= 2.2 - Unauthenticated Server Side Request Forgery

Description This plugin is vulnerable to server-side request forgery SSRF via the path parameter. Send a GET request to wpb-show-core/download-file.php with the path parameter set to an arbitrary URL http://example.com/latest/meta-data/iam/security-credentials/wpb-apps-prod-role the website will...