Hostname Spoofing

urijs is vulnerable to hostname spoofing. The hostname can be spoofed by using a backslash \ character followed by an @ character, which could potentially allow an attacker to bypass authorization if the hostname is used in security decisions...

CVE-2020-26291

URI.js is a javascript URL mutation library npm package urijs. In URI.js before version 1.19.4, the hostname can be spoofed by using a backslash \ character followed by an at @ character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and...

CVE-2020-26291

URI.js is a javascript URL mutation library npm package urijs. In URI.js before version 1.19.4, the hostname can be spoofed by using a backslash \ character followed by an at @ character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and...

Design/Logic Flaw

URI.js is a javascript URL mutation library npm package urijs. In URI.js before version 1.19.4, the hostname can be spoofed by using a backslash \ character followed by an at @ character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and...

Medialize urijs input validation error vulnerability

urijs is a Javascript URL mutation library. An input validation error vulnerability exists in urijs that stems from allowing hostname spoofing through the use of a backslash character followed by an at @ character. If a hostname is used in a security decision, the decision may be incorrect...

Hostname spoofing via backslashes in URL

Impact If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a backslash \ character followed by an at @ character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and attacker intent, impacts may...

GHSA-3329-PJWV-FJPG Hostname spoofing via backslashes in URL

Impact If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a backslash \ character followed by an at @ character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and attacker intent, impacts may...

CVE-2020-26291

CVE-2020-26291 affects the URI.js (urijs) library. In versions before 1.19.4, a hostname spoof can be performed by a backslash followed by an at character, potentially defeating security decisions and enabling bypasses of allow/block lists, SSRF, or open redirects depending on usage. Patched in 1...

CVE-2020-26291 Hostname spoofing in URI.js

URI.js is a javascript URL mutation library npm package urijs. In URI.js before version 1.19.4, the hostname can be spoofed by using a backslash \ character followed by an at @ character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and...

PT-2020-16409 · Medikoo · Uri.Js

Name of the Vulnerable Software and Affected Versions: URI.js versions prior to 1.19.4 Description: The hostname can be spoofed by using a backslash character followed by an at @ character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage an...

CVE-2020-35659

The DNS query log in Pi-hole before 5.2.2 is vulnerable to stored XSS. An attacker with the ability to directly or indirectly query DNS with a malicious hostname can cause arbitrary JavaScript to execute when the Pi-hole administrator visits the Query Log or Long-term data Query Log page...

Telerik Fiddler Code Injection Vulnerability

Telerik Fiddler is an HTTP protocol debugging proxy tool. A code injection vulnerability exists in Telerik Fiddler 5.0.20202.18177 and earlier versions, which allows an attacker to execute an arbitrary program via a hostname with a space character at the end, followed by the --utility-and-browser...

OpenJDK: HostnameChecker does not ensure X.509 certificate names are in normalized form (JSSE, 8237592)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: JSSE. Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to...

org.eclipse.paho.client.mqttv3: Improper hostname validation in the MQTT library

In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked. This could allow one MQTT server to impersonate another and provide the client library with incorrect information...

CVE-2020-17467

An issue was discovered in FNET through 4.6.4. The code for processing the hostname from an LLMNR request doesn't check for '\0' termination. Therefore, the deduced length of the hostname doesn't reflect the correct length of the actual data. This may lead to Information Disclosure in fnetllmnrpo...

Information disclosure

An issue was discovered in FNET through 4.6.4. The code for processing the hostname from an LLMNR request doesn't check for '\0' termination. Therefore, the deduced length of the hostname doesn't reflect the correct length of the actual data. This may lead to Information Disclosure in fnetllmnrpo...

CVE-2020-17467

The CVE-2020-17467 issue affects the FNET stack up to version 4.6.4, where hostname processing for LLMNR requests does not terminate with a null character. This can cause the code path in fnet_llmnr_poll to deduce an incorrect hostname length, enabling information disclosure in responses to malic...

PT-2020-15009 · Fnet · Fnet

Name of the Vulnerable Software and Affected Versions: FNET versions through 4.6.4 Description: An issue was discovered in the code for processing the hostname from an LLMNR request, which doesn't check for '0' termination. This may lead to Information Disclosure in fnet llmnr poll in fnet llmnr....

Opencast < 7.9, 8.0 < 8.9 Hostname Verification Vulnerability

Opencast is prone to a hostname verification vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

Man-in-the-Middle (MitM)

opencast-kernel is vulnerable to man-in-the-middle MitM. The vulnerability exists through the lack of hostname verification on the certificate when HTTPS connections are made...