CVE-2021-29642

GistPad before 0.2.7 allows a crafted workspace folder to change the URL for the Gist API, which leads to leakage of GitHub access tokens...

CVE-2019-15302

The pad management logic in XWiki labs CryptPad before 3.0.0 allows a remote attacker who has access to a Rich Text pad with editing rights for the URL to corrupt it i.e., cause data loss via a trivial URL modification...

CVE-2012-2647

Yahoo! Toolbar 1.0.0.5 and earlier for Chrome and Safari allows remote attackers to modify the configured search URL, and intercept search terms, via a crafted web page...

CVE-2025-25281

An attacker may modify the URL to discover sensitive information about the target network...

CVE-2025-25281 Outback Power Mojave Inverter Exposure of Sensitive Information to an Unauthorized Actor

An attacker may modify the URL to discover sensitive information about the target network...

CVE-2024-47870 Race condition in update_root_in_config may redirect user traffic in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a race condition in the updaterootinconfig function, allowing an attacker to modify the root URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker ca...

CVE-2024-44117

The RFC enabled function module allows a low privileged user to perform various actions, such as modifying the URLs of any user's favourite nodes and workbook ID. There is low impact on integrity and availability of the application...

CVE-2023-49198 Apache SeaTunnel Web: Arbitrary file read vulnerability

Mysql security vulnerability in Apache SeaTunnel. Attackers can read files on the MySQL server by modifying the information in the MySQL URL allowLoadLocalInfile=true&allowUrlInLocalInfile=true&allowLoadLocalInfileInPath=/&maxAllowedPacket=655360 This issue affects Apache SeaTunnel: 1.0.0. Users...

CVE-2024-6738

The tumbnail API of Tronclass from WisdomGarden lacks proper access control, allowing unauthenticated remote attackers to obtain certain specific files by modifying the URL...

CVE-2024-6738 WisdomGarden Tronclass - Broken Access Control

The tumbnail API of Tronclass from WisdomGarden lacks proper access control, allowing unauthenticated remote attackers to obtain certain specific files by modifying the URL...

CVE-2024-6738 WisdomGarden Tronclass - Broken Access Control

The tumbnail API of Tronclass from WisdomGarden lacks proper access control, allowing unauthenticated remote attackers to obtain certain specific files by modifying the URL...

CVE-2024-6738

CVE-2024-6738 concerns WisdomGarden’s Tronclass: the thumbnail API lacks access control, allowing unauthenticated remote attackers to obtain certain files by modifying the URL. The initial NVD entry provides a medium severity estimate (CVSSv3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) with a network...

CVE-2024-5257

An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Developer user with admincomplianceframework custom role may have been able to modify the URL for a group namespace...

CVE-2024-5257

CVE-2024-5257 affects GitLab CE/EE: all versions from 17.0 before 17.0.4 and from 17.1 before 17.1.2. A Developer user with the admin_compliance_framework custom role may have been able to modify the URL for a group namespace, indicating an improper access-control issue. Remediation: upgrade to 1...

CVE-2024-5257 Improper Access Control in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Developer user with admincomplianceframework custom role may have been able to modify the URL for a group namespace...

GitLab Security Breach

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab CE/EE version 17.0 up to and includi...

GitLab 17.0 < 17.0.4 / 17.1 < 17.1.2 (CVE-2024-5257)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Developer user with admincomplianceframework custom role may hav...

Lobe Chat API Key Leak

Summary If an attacker can successfully authenticate through SSO/Access Code, they can obtain the real backend API Key by modifying the base URL to their own attack URL on the frontend and setting up a server-side request. Details The attack process is described above. PoC Frontend: 1. Pass basic...

CVE-2024-2052

CWE-552: Files or Directories Accessible to External Parties vulnerability exists that could allow unauthenticated files and logs exfiltration and download of files when an attacker modifies the URL to download to a different location...

CVE-2024-2052

The CVE-2024-2052 issue concerns Schneider Electric Easergy T200 (SC2-04MOD-07000104 and prior) with CWE-552: Files or Directories Accessible to External Parties. An attacker can modify the URL to download log files or other data, enabling unauthenticated exfiltration. Documents indicate affected...