CVE-2020-26938

In oauth2-server aka node-oauth2-server through 3.1.1, the value of the redirecturi parameter received during the authorization and token request is checked against an incorrect URI pattern "a-zA-Za-zA-Z0-9+.-+:" before making a redirection. This allows a malicious client to pass an XSS payload...

PT-2022-8851 · Unknown · Oauth2-Server

Name of the Vulnerable Software and Affected Versions: oauth2-server aka node-oauth2-server versions 3.1.1 and earlier Description: The issue arises from an incorrect URI pattern a-zA-Za-zA-Z0-9+.-+: used to check the redirect uri parameter during authorization and token requests. This flaw allow...

oauth2-server 输入验证错误漏洞

oauth2-server is a standards-compliant implementation of OAuth 2.0 authorization server written in PHP for individual developers . Provides authentication and authorization features for applications to protect API security. A security vulnerability exists in oauth2-server node-oauth2-server versi...

Ubuntu: Security Advisory (USN-5546-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Regular Expression Denial Of Service (ReDoS)

uri-template-lite is vulnerable to regular expression denial of service. The vulnerability exists due to the insecure regex pattern used for the expandRe attribute in index.js, allowing an attacker to crash the application by providing a malicious input through the URI.expand method...

@outfoxx/sunday (1.1.0-alpha.19) potentially affected by CVE-2021-43309 via uri-template-lite (22.1.0)

uri-template-lite NPM version 22.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on uri-template-lite and may be impacted: - @outfoxx/sunday 1.1.0-alpha.19 Source cves: CVE-2021-43309 Source advisory: OSV:GHSA-CHW2-6C7R-37P7...

GHSA-CHW2-6C7R-37P7 uri-template-lite Regular Expression Denial of Service

An exponential ReDoS Regular Expression Denial of Service can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the "URI.expand" method...

CVE-2021-43309

An exponential ReDoS Regular Expression Denial of Service can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the "URI.expand" method...

Design/Logic Flaw

An exponential ReDoS Regular Expression Denial of Service can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the "URI.expand" method...

CVE-2021-43309 ReDoS in uri-template-lite URI.expand function

An exponential ReDoS Regular Expression Denial of Service can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the "URI.expand" method...

CVE-2021-43309

CVE-2021-43309 affects the uri-template-lite npm package. The root cause is an insecure regular expression (expandRe) in index.js used by URI.expand, enabling exponential ReDoS when attacker-controlled input is supplied. Impact is denial of service affecting availability. Public exploit details a...

PT-2022-11821 · Npm · Uri-Template-Lite

Name of the Vulnerable Software and Affected Versions: uri-template-lite npm package affected versions not specified Description: An exponential ReDoS Regular Expression Denial of Service can be triggered in the uri-template-lite npm package when an attacker is able to supply arbitrary input to t...

PT-2022-7389

Name of the Vulnerable Software and Affected Versions decode-uri-component version 0.2.0 Confluence Data Center versions 7.0.1 through 9.0.x Description The issue is related to improper input validation, which can result in a denial of service DoS. This can be exploited by a remote attacker,...

CVE-2021-28861

A vulnerability was found in python. This security flaw causes an open redirection vulnerability in lib/http/server.py due to no protection against multiple / at the beginning of the URI path. This issue may lead to information disclosure...

CVE-2021-28861

Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple / at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states...

AZL-10618 CVE-2021-28861 affecting package python3 for versions less than 3.9.19-1

Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple / at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states...

CVE-2021-28861

Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple / at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states...

CVE-2021-28861

Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple / at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states...

Remote Code Execution

flysystem is vulnerable to remote code execution. Lack of proper parameter validation in JMSMessageConsumer allows an attacker to upload and execute malicious code on the system under attack, when a configuration uses a JMS Source with a JNDI LDAP data source URI...

Remote code execution in Apache Flume

Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java...