CVE-2022-1157: Insertion of Sensitive Information into Log File

Missing sanitization of logged exception messages in all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 of GitLab CE/EE causes potential sensitive values in invalid URLs to be logged...

Invalid Short URL Generation

bitlyshortener is vulnerable to Invalid Short URL Generation. The vulnerability exists due to upstream brake allowing an attacker to generate invalid short URLs...

CVE-2021-43803

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom...

CVE-2021-43803 Unexpected server crash in Next.js

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom...

GHSA-25MP-G6FV-MQXX Unexpected server crash in Next.js.

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom...

PT-2021-23945

Name of the Vulnerable Software and Affected Versions: Next.js versions prior to 12.0.5 Next.js versions prior to 11.1.3 Description: The issue arises when invalid or malformed URLs are processed, potentially leading to a server crash. This can occur in deployments using Next.js versions above...

Inefficient Regular Expression Complexity in yiminghe/async-validator

✍️ Description It allows cause a denial of service when validating crafted invalid URLs. 🕵️‍♂️ Proof of Concept // PoC.js var asyncValidator = require"async-validator" const validator = new asyncValidator.default v: type: 'url', , forvar i = 1; i = 50000; i++ var time = Date.now; var attackstr =...

PAN-OS: Invalid URLs in an External Dynamic List (EDL) can Lead to Firewall Outage

Certain invalid URL entries contained in an External Dynamic List EDL cause the Device Server daemon devsrvr to stop responding. This condition causes subsequent commits on the firewall to fail and prevents administrators from performing commits and configuration changes even though the firewall...

Regular expression deinal of service in express-validators

All versions of package express-validators are vulnerable to Regular Expression Denial of Service ReDoS when validating specifically-crafted invalid urls...

Arbitrary Code Execution

chromium is vulnerable to arbitrary code execution. A remote attacker to execute arbitrary code in an arbitrary origin via a malicious HTML page due to incorrect handling of failed navigations with invalid URLs...

CVE-2020-7767

All versions of package express-validators are vulnerable to Regular Expression Denial of Service ReDoS when validating specifically-crafted invalid urls...

Design/Logic Flaw

All versions of package express-validators are vulnerable to Regular Expression Denial of Service ReDoS when validating specifically-crafted invalid urls...

CVE-2020-7767: Uncontrolled Resource Consumption

All versions of package express-validators are vulnerable to Regular Expression Denial of Service ReDoS when validating specifically-crafted invalid urls...

Invalid Short URL Generation

bitlyshortener generates invalid short URLs. An upstream breaking change allows invalid short URLs to be generated...

Cross site scripting

Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting XSS from invalid URLs...

CVE-2017-18352

Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting XSS from invalid URLs...

CVE-2017-18352

Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting XSS from invalid URLs...

CVE-2017-18352

Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting XSS from invalid URLs...

CVE-2017-18352: Improper Neutralization of Input During Web Page Generation

Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting XSS from invalid URLs...

PT-2018-6847

Name of the Vulnerable Software and Affected Versions: Rendertron version 1.0.0 Description: The issue allows for reflected Cross Site Scripting XSS from invalid URLs due to error reporting. Recommendations: For Rendertron version 1.0.0, update to a version that fixes the error reporting issue to...