Possible URL spoofing on wildcard path

Description H3 provides the getRequestURL utility using the new URLa, b constructor. When variable a is attacker-controlled the origin of the resulting URL can be modified. Proof of Concept js // index.js import listen from "listhen"; import createApp, createRouter, eventHandler, toNodeListener,...

Auth bypass via unproper use of getRequestURL()

Description The wgcloud uses getRequestURL improperly, an attacker could craft an URL that bypasses the auth of wgcloud Normally, when browsering http://ip:9999/wgcloud/dash/main with no auth, you will be redirected to /wgcloud/login/toLogin, but this vuln could bypass this. Proof of Concept curl...