EUVD-2002-0006

Malware in sbrugna...

EUVD-2005-3364

Malware in sbrugna...

CVE-2025-27553

A flaw was found in Apache Commons VFS. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains...

PT-2025-12535

Name of the Vulnerable Software and Affected Versions: Apache Commons VFS versions prior to 2.10.0 Description: The FileObject API in Commons VFS has a resolveFile method that takes a scope parameter. Specifying NameScope.DESCENDENT promises that an exception is thrown if the resolved file is not...

CVE-2020-11053

In OAuth2 Proxy before 5.1.1, there is an open redirect vulnerability. Users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is check...

Credentials Exposure

github.com/git-lfs/git-lfs is vulnerable to Credential Exposure. The vulnerability is due to improper handling of URL-encoded control characters in Git LFS, which passes portions of a host's URL containing embedded line-ending control characters e.g., LF or CR to the git-credential command withou...

CVE-2024-45514

Summary: CVE-2024-45514 affects Zimbra Collaboration (ZCS) Webmail; a Cross-Site Scripting (XSS) flaw arises from insufficient sanitization of the packages parameter in one endpoint. Attackers can bypass checks by using encoded characters to inject and execute JavaScript in a victim’s session. Wh...

CVE-2024-23983 Access rules for PingAccess may be circumvented with URL-encoded characters

Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules...

The vulnerabilities of the functions AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding(), and AppendEncodedCharacters() in browsers Mozilla Firefox, Firefox ESR, and the email client Thunderbird allow an attacker to execute arbitrary code.

The vulnerabilities of the functions AppendEncodedAttributeValue, ExtraSpaceNeededForAttrEncoding, and AppendEncodedCharacters in browsers such as Mozilla Firefox, Firefox ESR, and the email client Thunderbird are related to integer overflow. Exploiting these vulnerabilities allows a malicious...

Mozilla: Integer overflow could have led to out of bounds write

The Mozilla Foundation Security Advisory describes this flaw as: AppendEncodedAttributeValue, ExtraSpaceNeededForAttrEncoding and AppendEncodedCharacters could have experienced integer overflows, causing underallocation of an output buffer leading to an out of bounds write...

Mozilla: Integer overflow could have led to out of bounds write

The Mozilla Foundation Security Advisory describes this flaw as: AppendEncodedAttributeValue, ExtraSpaceNeededForAttrEncoding and AppendEncodedCharacters could have experienced integer overflows, causing underallocation of an output buffer leading to an out of bounds write...

PT-2024-1513 · Unknown +2 · Libmodsecurity +3

Name of the Vulnerable Software and Affected Versions: ModSecurity / libModSecurity versions 3.0.0 through 3.0.11 Description: The issue is related to a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 decodes percent-encoded characters present in...

Run malicious JS code with other kinds of encoding

Description We can Run malicious JS code With special escaping characters for ASCII chars that start with \x and also all Unicodes start with \u, like the followings : CR == \x0d and \u000d LF == \x0a and \u000a TAB == \t and \u0009 and \x09 So there can be many characters that we can't filter al...

GHSA-5MQ8-H82P-WJF2 Jetty Javascript Inclusion Vulnerability

Cross-site scripting XSS vulnerability in Jetty JSP servlet engine allows remote attackers to insert arbitrary HTML or script via an HTTP request to a .jsp file whose name contains the malicious script and some encoded linefeed characters %0a...

jetty: crafted URIs allow bypassing security constraints

For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc...

Security update for jetty-minimal (moderate)

openSUSE Security Update: Security update for jetty-minimal Announcement ID: openSUSE-SU-2021:2838-1 Rating: moderate References: 1188438 Cross-References: CVE-2021-34429 CVSS scores: CVE-2021-34429 NVD : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2021-34429 SUSE: 6.5...

Information Disclosure

jetty-http is vulnerable to information disclosure. Insecure parsing of encoded characters allow an attacker to bypass security constraints and potentially access private files within the WEB-INF directory...

CVE-2021-34429

For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc...

Information Disclosure

jetty-server is vulnerable to information disclosure. The URI normalisation in default compliance mode does not escape % encoded characters in the request metadata by common Servlet implementations, allowing access to sensitive resources within the WEB-INF directory via the use of URI with %2e or...

Secret disclosure

Overview Secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that become encoded when included in a URL. Recommendation Upgrade to version 17.2.3 or later References - https://github.com/advisories/GHSA-r2j6-p67h-q639...