CVE-2025-1022

Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html, which can be bypassed by omitting the slashes in the file URI e.g., file:../../../../etc/passwd. This is due to missing validations of the use...

EUVD-2019-15409

Malware in sbrugna...

EUVD-2019-19302

Malware in sbrugna...

EUVD-2021-3592

Malicious code in bioql PyPI...

CVE-2021-0973

In isFileUri of UriUtil.java, there is a possible way to bypass ignoring file://URI attachment due to improper handling of case sensitivity. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product:...

CVE-2022-20205

In isFileUri of FileUtil.java, there is a possible way to bypass the check for a file:// scheme due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersion...

PT-2019-4836

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 75.0.3770.80 Description The issue is related to insufficient policy enforcement in the extensions API, allowing an attacker to bypass restrictions on file URIs via a crafted Chrome Extension. This could be...

CVE-2018-18497

Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to load multiple pages as a single argument. This could allow a malicious WebExtension to open privileged about: or file: locations. This...