SUSE CVE-2022-27779

libcurl wrongly allows cookies to be set for Top Level Domains TLDs if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without Public Suffix Listawareness. If PSL support not provided, a more rudimentary check...

PT-2022-37274 · Git +1 · Hunspell

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read, which occurs in the SfxEntry::add, AffixMgr::expand rootword, and SuggestMgr::ngsuggest functions. N...

CVE-2022-34776

Tabit - giftcard stealth. Several APIs on the web system display, without authorization, sensitive information such as health statements, previous bills in a specific restaurant, alcohol consumption and smoking habits. Each of the described APIs, has in its URL one or more MongoDB ID which is not...

libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.

...

CVE-2022-27779

libcurl wrongly allows cookies to be set for Top Level Domains TLDs if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without Public Suffix Listawareness. If PSL support not provided, a more rudimentary check...

AZL-9908 CVE-2022-27779 affecting package curl for versions less than 7.83.1-1

libcurl wrongly allows cookies to be set for Top Level Domains TLDs if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without Public Suffix Listawareness. If PSL support not provided, a more rudimentary check...

DEBIAN-CVE-2022-27779

libcurl wrongly allows cookies to be set for Top Level Domains TLDs if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without Public Suffix Listawareness. If PSL support not provided, a more rudimentary check...

CVE-2022-30007

GXCMS V1.5 has a file upload vulnerability in the background. The vulnerability is the template management page. You can edit any template content and then rename to PHP suffix file, after calling PHP file can control the server...

Tryton Information Disclosure Vulnerability

fileopen in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a "same root name but with a suffix" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242...

cookie for trailing dot TLD

libcurl wrongly allows HTTP cookies to be set for Top Level Domains TLDs if the hostname is provided with a trailing dot. curl can be told to receive and send cookies when communicating using HTTPS. curl's "cookie engine" can be built with or without Public Suffix List awareness. If PSL support n...

CVE-2022-27779

libcurl wrongly allows cookies to be set for Top Level Domains TLDs if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without Public Suffix Listawareness. If PSL support not provided, a more rudimentary check...

CVE-2022-29001

In SpringBootMovie =1.2, the uploaded file suffix parameter is not filtered, resulting in arbitrary file upload vulnerability...

CVE-2022-29001

In SpringBootMovie =1.2, the uploaded file suffix parameter is not filtered, resulting in arbitrary file upload vulnerability...

SpringBootMovie 代码问题漏洞

SpringBootMovie is a Spring Boot based movie website. A security vulnerability exists in SpringBootMovie version 1.2 and earlier versions, which stems from an unfiltered upload file suffix parameter, resulting in an arbitrary file upload vulnerability...

April 21, 2022—KB5012636 (OS Build 17763.2867) Preview

None None...

Smokescreen 代码问题漏洞

Smokescreen is an HTTP CONNECT proxy. A security vulnerability exists in Smokescreen that originates from the ability to bypass the denial list feature by appending a dot to the end of a user-supplied URL or by providing input in a different letter case...

Adding Akamai Shared Domains to the Public Suffix List

Akamai plans to submit a number of our shared domains to the “PRIVATE” section of the Public Suffix List PSL at some point on or after March 31, 2022. The PSL contains multi-party domain suffixes and is used by a wide range of client software for example, web browsers to implement policy decision...

GHSA-MFJM-VH54-3F96 Scrapy cookie-setting is not restricted based on the public suffix list

Impact Responses from domain names whose public domain name suffix contains 1 or more periods e.g. responses from example.co.uk, given its public domain name suffix is co.uk are able to set cookies that are included in requests to any other domain sharing the same domain name suffix. Patches...

Scrapy cookie-setting is not restricted based on the public suffix list

Impact Responses from domain names whose public domain name suffix contains 1 or more periods e.g. responses from example.co.uk, given its public domain name suffix is co.uk are able to set cookies that are included in requests to any other domain sharing the same domain name suffix. Patches...

Authorization bypass in Istio

In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes e.g. -some-suffix for source principals or namespace fields, callers will never be denied access, bypassing the intended policy. Specific Go...