CVE-2021-43798

A directory path traversal vulnerability was found in Grafana. This flaw allows an attacker to obtain read access to the local files due to a lack of path normalization in the /public/plugins// URL...

CVE-2021-26615

ARK library allows attackers to execute remote code via the parameterpath value of ArkNormalizeAndDupPAthNameW function because of an integer overflow...

ARK library 输入验证错误漏洞

Bandisoft ARK library is a library from Bandisoft Korea that decompresses most of the existing compression formats such as ZIP, RAR, ALZ, EGG, etc. in various OS environments such as Windows, macOS, Linux, etc. and creates compressed files in ZIP/7Z format. A security vulnerability exists in the...

JBCS: URL normalization issue with dot-dot-semicolon(s) leads to information disclosure

A flaw was found in Red Hat JBoss Core Services HTTP Server in all versions, where it does not properly normalize the path component of a request URL contains dot-dot-semicolons. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest...

PYSEC-2021-384

FirstUseAuthenticator is a JupyterHub authenticator that helps new users set their password on their first login to JupyterHub. When JupyterHub is used with FirstUseAuthenticator, a vulnerability in versions prior to 1.0.0 allows unauthorized access to any user's account if createusers=True and t...

Command Execution Vulnerability in Apache HTTP Server 2.4.49

Apache HTTP Server is the United States Apache Apache Software Foundation, an open source web server. The server is fast, reliable and can be expanded through a simple API. A command execution vulnerability exists in Apache HTTP Server 2.4.49 due to a flaw in the changes made to path normalizatio...

Path Traversal

apache2 has path traversal. The vulnerability exists due to a flaw found in a change made to path normalization...

Exploit for Path Traversal in Apache Http_Server

CVE-2021-41773 PoC Proof of concept to check if hosts are vul...

IndexPool._pow wrong loop and does not normalize values

Handle cmichel Vulnerability details The IndexPool.compute function is indented as if the if n % 2 != 0 output = output a; is inside the loop but there are actually not braces around it. It must be in the loop for the exponentiation by repeated squaring algorithm to work: function powuint256 a,...

CVE-2021-22017

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed...

CVE-2021-22017

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed...

CVE-2021-22017

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed...

CVE-2021-22017

Summary of CVE-2021-22017 : VMware vCenter Server’s rhttp proxy (rhttproxy) has an improper URI normalization implementation that can be exploited by a remote attacker with network access to port 443 to bypass proxy restrictions and access internal endpoints. The vulnerability affects vCenter Ser...

PT-2021-4316

Name of the Vulnerable Software and Affected Versions vCenter Server affected versions not specified Description The issue is related to improper implementation of URI normalization in the rhttproxy service used by vCenter Server. This allows a malicious actor with network access to port 443 on...

CVE-2021-22017

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed. Recent assessments: Assessed...

VMware vCenter Server < 6.5 U3q Multiple Vulnerabilities (VMSA-2021-0020)

The version of VMware vCenter Server installed on the remote host is 6.5 prior to 6.5 U3q. It is, therefore, affected by multiple vulnerabilities: - A privilege escalation vulnerability exists in vCenter Server due to the way it handles session tokens. An authenticated, local attacker can exploit...

VMware vCenter Server 授权问题漏洞

VMware vCenter Server is a suite of server and virtualization management software from VMware. The software provides a centralized platform for managing VMware vSphere environments, automating the implementation and delivery of virtual infrastructures. An authorization issue vulnerability exists ...

The vulnerability of the system administration utility is related to insecure management of privileges, which allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the system administration utility is related to an error during the normalization of umask. Exploiting this vulnerability can allow a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures...

Vault.withdraw mixes normalized and standard amounts

Handle cmichel Vulnerability details The Vault.balance function uses the balanceOfThis function which scales "normalizes" all balances to 18 decimals. for uint8 i; i 0 controller.withdrawoutput, toWithdraw; uint256 after = IERC20output.balanceOfaddressthis; uint256 diff = after.subbalance; if dif...

Vault does not normalize decimal on withdrawing

Handle jonah1005 Vulnerability details Impact The vault does not normalize decimals when a user withdraws the token. When a user has 100e18 shares, he can withdraw all usdc/ usdt from the token. The liquidity of USDC/USDC would be drained. I consider this is a high-risk issue. Proof of Concept...