Truecaller : Lack of URL Validation in avatarUrl at /v4/profile

The endpoint "profile4-noneu.truecaller.com/v4/profile" was found to have a lack of URL validation in the "avatarUrl" parameter. The validation only checked if the URL started with "https" and contained the string "images-noneu.truecallerstatic.com", allowing attackers to craft fake URLs by addin...

CVE-2022-27197: Improper Neutralization of Input During Web Page Generation

Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure views...