The vulnerability of the UriComponentsBuilder component in the Spring Framework’s URL analysis mechanism allows attackers to perform SSRF attacks.

The vulnerability of the UriComponentsBuilder component in the Spring Framework’s URL analysis module exists due to insufficient validation of data entered by users. Exploiting this vulnerability could allow a malicious actor to perform an SSRF attack remotely...

UBUNTU-CVE-2024-22262

Applications that use UriComponentsBuilder to parse an externally provided URL e.g. through a query parameter AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is...

PT-2024-2941

Name of the Vulnerable Software and Affected Versions Spring Framework versions prior to 5.3.34 Spring Framework versions prior to 6.0.19 Spring Framework versions prior to 6.1.6 Description The issue exists due to insufficient validation of user-input data in the UriComponentsBuilder component o...

DEBIAN-CVE-2024-22259

Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL e.g. through a query parameter AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF...

UBUNTU-CVE-2024-22259

Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL e.g. through a query parameter AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF...

RHEL 9 : haproxy (RHSA-2024:1142)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:1142 advisory. The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes: haproxy...

GHSA-CCGV-VJ62-XF9H Spring Web vulnerable to Open Redirect or Server Side Request Forgery

Applications that use UriComponentsBuilder to parse an externally provided URL e.g. through a query parameter AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect attack or to a SSRF attack if the URL is used after passing validation checks...

UBUNTU-CVE-2024-22243

Applications that use UriComponentsBuilder to parse an externally provided URL e.g. through a query parameter AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is...

CLSA-2023-1703183093 haproxy: Fix of CVE-2023-45539

CVE-2023-45539: do not accept '' as part of the URI component...

CLSA-2023-1703181305 haproxy: Fix of CVE-2023-45539

CVE-2023-45539: h1: do not accept '' as part of the URI component; h2: reject more chars from the :path pseudo header...

CLSA-2023-1703008559 Fix CVE(s): CVE-2023-45539

SECURITY UPDATE: Accepting '' as part of the URI component might allow remote attackers to obtain sensitive information or have unspecified other impact - debian/patches/CVE-2023-45539.patch: h1: do not accept '' as part of the URI component; h2: reject more chars from the :path pseudo header -...

USN-6530-1 haproxy vulnerability

It was discovered that HAProxy incorrectly handled URI components containing the hash character . A remote attacker could possibly use this issue to obtain sensitive information, or to bypass certain pathend rules...

PT-2023-8863

Name of the Vulnerable Software and Affected Versions HAProxy versions prior to 2.8.2 Description The issue is related to HAProxy accepting as part of the URI component. This could allow remote attackers to obtain sensitive information or have other unspecified impacts due to the misinterpretatio...

Design/Logic Flaw

Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing information about the underlying technology and other sensitive information details. The website unintentionally reveals sensitive information including technical detai...

Mac OS X 10.12 isolation mechanism bypass vulnerability

Vulnerability summary Mac OS X a vulnerability exists that could allow an attacker to bypass the Apple of the isolation mechanism, without any restrictions to execute arbitrary JavaScript code. Vulnerability submitter From WeAreSegment security researcher Filippo Cavallarin to Beyond Security SSD...

CVE-2016-10397

In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser could be used by attackers to bypass hostname-specific URL checks, as demonstrated by evil.example.com:[email protected]/ and evil.example.com:[email protected]/ inputs to the parseurl...

CVE-2016-10397

In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser could be used by attackers to bypass hostname-specific URL checks, as demonstrated by evil.example.com:[email protected]/ and evil.example.com:[email protected]/ inputs to the parseurl...