CVE-2020-28724

Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL...

Pallets Werkzeug 输入验证错误漏洞

Werkzeug is a comprehensive library for WSGI web applications. werkzeug versions prior to 0.11.6 are vulnerable to redirection. An attacker could exploit the vulnerability to redirect users to an arbitrary url via a double slash in the URL...

httpd: URL normalization inconsistency

A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes '/', directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing wi...

UBUNTU-CVE-2015-2750

Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the "//" initial sequence...

GitLab: [Repository Import] Open Redirect via "continue[to]" parameter

Hi, While experimenting with Repository Import functionality on a fresh GitLab 9.0 CE install, I noticed that the continueto parameter can be used to perform an Open Redirect through the inclusion of a double-slash prefix. Proof of Concept The following Proof of Concept URL enables a malicious...

AZL-45312 CVE-2015-1164 affecting package nodejs-nodemon 2.0.3-5

Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // slash slash followed by a domain in the PATHINFO to the default URI...

DEBIAN-CVE-2014-0480

The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // slash slash in a URL, which triggers a scheme-relative URL...

Apache ActiveMQ 5.2/5.3 Source Code Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/39636/info Apache ActiveMQ is prone to a vulnerability that lets attackers access source code because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve arbitrary fil...

Microsoft Internet Explorer 6.0 Double Slash Cache Zone Bypass Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8980/info A vulnerability has been reported in Internet Explorer that may allow cached Internet content to be rendered in the My Computer zone. It is possible to exploit this issue by including an extra slash when...

Apache ActiveMQ Double Slash Request Source Code Disclosure

The version of Apache ActiveMQ hosted on the remote web server is affected by a source code disclosure vulnerability in the Jetty ResourceHandler when handling requests to a JSP file with additional leading slashes. A remote attacker can exploit this to disclose the source code of pages, which ma...

Femitter FTP Server 1.03 - Arbitrary File Disclosure

Femitter FTP Server 1.03 - Arbitrary File Disclosure !/usr/bin/perl Femitter FTP Server 1.03 Arbitrary File Disclosure Exploit Like ftpdmin 0.96 the same exploit but here is work just with double slach not 1 :d xd By stack Cyber-Zone use LWP::Simple; use LWP::UserAgent; if @ARGV \n"; print"TARGET...

Path traversal

Absolute path traversal vulnerability in MLDonkey 2.8.4 through 2.9.7 allows remote attackers to read arbitrary files via a leading "//" double slash in the filename...

CVE-2009-0753

CVE-2009-0753 affects MLDonkey 2.8.4–2.9.7 where the web interface mishandles filenames with leading //, enabling a remote attacker to read arbitrary files. Gentoo GLSA-200903-36 and Debian/Fedora advisories document this as an information-disclosure vulnerability via the web interface. The recom...

MLdonkey <= 2.9.7 HTTP DOUBLE SLASH Arbitrary File Disclosure Vuln

Exploit for multiple platform in category remote exploits ================================================================== MLdonkey = 2.9.7 HTTP DOUBLE SLASH Arbitrary File Disclosure Vuln ================================================================== MLdonkey up to 2.9.7 has a vulnerabilit...

Mort Bay Jetty < 6.1.7 Double Slash Information Disclosure

Binary data 4330.prm...

CVE-2003-1138

The default configuration of Apache 2.0.40, as shipped with Red Hat Linux 9.0, allows remote attackers to list directory contents, even if auto indexing is turned off and there is a default web page configured, via a GET request containing a double slash //...

security flaw

Multiple directory traversal vulnerabilities in LHA 1.14 allow remote attackers or local users to create arbitrary files via an LHA archive containing filenames with 1 .. sequences or 2 absolute pathnames with double leading slashes "//absolute/path"...

Internet Explorer Vulnerability: Content-Location works with both triple and double slash

After I reported the Content-Location Vulnerability http://www.securityfocus.com/archive/1/342317, Thor Larholm explained that the html execution was not caused by the Content-Location header, but instead by the triple slash file:///. I have tested it with double slash and I even tested the tripl...

Microsoft Internet Explorer 6 - Double Slash Cache Zone Bypass

source: https://www.securityfocus.com/bid/8980/info A vulnerability has been reported in Internet Explorer that may allow cached Internet content to be rendered in the My Computer zone. It is possible to exploit this issue by including an extra slash when referencing cached content from within a...