421 matches found
CVE-2021-23384
The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::removeTrailingSlashes, as the web serve...
CVE-2021-23384
The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::removeTrailingSlashes, as the web serve...
CVE-2021-23384: URL Redirection to Untrusted Site
The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::removeTrailingSlashes, as the web serve...
PT-2021-15479
Name of the Vulnerable Software and Affected Versions koa-remove-trailing-slashes versions prior to 2.0.2 Description The issue allows for Open Redirect via the use of trailing double slashes in the URL when accessing a vulnerable endpoint, such as https://example.com//attacker.example/. The...
Red Hat Ceph 输入验证错误漏洞
Red Hat Ceph is a Linux petabyte-level distributed file system from Red Hat. The main goal of the system is to be designed as a distributed file system without a single point of failure based on POSIX Portable Operating System Interface, enabling fault tolerance and seamless data replication. Cep...
envoyproxy/envoy: HTTP request with escaped slash characters can bypass Envoy's authorization mechanisms
An authorization bypass vulnerability was found in envoyproxy/envoy. An attacker can potentially craft an HTTP request that defines a certain pattern of escaped characters in the URI path such as %2F, %2f, %5C or %5c, allowing them to bypass the envoy authorization service. The highest threat fro...
istio/istio: HTTP request with escaped slash characters can bypass authorization mechanisms
An authorization bypass flaw was found in Istio. This flaw allows an attacker to craft an HTTP request that defines a certain pattern of escaped characters in the URI path such as %2F, %2f, %5C, or %5c, allowing them to bypass the authorization service. The highest threat from this vulnerability ...
envoyproxy/envoy: HTTP request with escaped slash characters can bypass Envoy's authorization mechanisms
An authorization bypass vulnerability was found in envoyproxy/envoy. An attacker can potentially craft an HTTP request that defines a certain pattern of escaped characters in the URI path such as %2F, %2f, %5C or %5c, allowing them to bypass the envoy authorization service. The highest threat fro...
PT-2021-3578 · Apache +9 · Apache Http Server +9
Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions 2.4.39 through 2.4.46 Description: The issue exists due to insufficient input validation in the Apache HTTP Server. Exploitation of this issue may allow a remote attacker to impact the integrity of protected...
Open Redirect
Overview koa-remove-trailing-slashes is a Koa middleware that makes sure all requests does not have trailing slashes Affected versions of this package are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as...
Open Redirect
Overview trailing-slash is an Add or remove trailing slashes, and redirect. Affected versions of this package are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable cod...
PT-2021-5463 · Red Hat +5 · Red Hat Ceph Storage +5
Name of the Vulnerable Software and Affected Versions: Red Hat Ceph Storage RGW versions prior to 14.2.21 Description: The issue is related to incorrect handling of a URL that ends with two slashes, which can cause the system to crash, resulting in a denial of service. This can be exploited by a...
mod_auth_openidc: Open redirect in logout url when using URLs with leading slashes
An open redirect flaw was discovered in modauthopenidc, where it handles logout redirection. The module does not correctly validate the URL, allowing a URL with leading slashes to bypass the protection checks. A victim user may be tricked into visiting a trusted vulnerable web site, which would...
httpd: URL normalization inconsistency
A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes '/', directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing wi...
httpd: URL normalization inconsistency
A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes '/', directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing wi...
The vulnerability of the RewriteRule module in the Apache web server, related to the use of incorrect URL names, allows attackers to access sensitive data.
The vulnerability of the RewriteRule module in the Apache web server is related to incorrect processing of requests that contain several slash characters /. Exploiting this vulnerability allows an attacker who operates remotely to gain access to confidential data...
DEBIAN-CVE-2015-2060
cabextract before 1.6 does not properly check for leading slashes when extracting files, which allows remote attackers to conduct absolute directory traversal attacks via a malformed UTF-8 character that is changed to a UTF-8 encoded slash...
CVE-2019-14857
A flaw was found in modauthopenidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in modauthmellon...
