11 matches found
CVE-2026-44437: Improper Limitation of a Pathname to a Restricted Directory
The Angular SSR is a server-rise rendering tool for Angular applications. From 19.0.0-next.0 to before 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7, a vulnerability exists in the X-Forwarded-Prefix header processing logic within Angular SSR. The internal validation mechanism fails to properly...
CVE-2025-66490
Traefik is an HTTP reverse proxy and load balancer. For versions prior to 2.11.32 and 2.11.31 through 3.6.2, requests using PathPrefix, Path or PathRegex matchers can bypass path normalization. When Traefik uses path-based routing, requests containing URL-encoded restricted characters /, , Null,...
CVE-2025-66490: Interpretation Conflict
Traefik is an HTTP reverse proxy and load balancer. For versions prior to 2.11.32 and 2.11.31 through 3.6.2, requests using PathPrefix, Path or PathRegex matchers can bypass path normalization. When Traefik uses path-based routing, requests containing URL-encoded restricted characters /, , Null,...
Credentials Exposure
github.com/git-lfs/git-lfs is vulnerable to Credential Exposure. The vulnerability is due to improper handling of URL-encoded control characters in Git LFS, which passes portions of a host's URL containing embedded line-ending control characters e.g., LF or CR to the git-credential command withou...
CVE-2024-23983 Access rules for PingAccess may be circumvented with URL-encoded characters
Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules...
Unspecified Vulnerability in Mozilla Firefox (CNVD-2021-18236)
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in the handling of URL-encoded characters in versions prior to Mozilla Firefox 78. An attacker could exploit this vulnerability to bypass security restrictions...
CVE-2010-0642
Cisco Collaboration Server CCS 5 allows remote attackers to read the source code of JHTML files via URL encoded characters in the filename extension, as demonstrated by 1 changing .jhtml to %2Ejhtml, 2 changing .jhtml to .jhtm%6C, 3 appending %00 after .jhtml, and 4 appending %c0%80 after .jhtml,...
CVE-2010-0642
Cisco Collaboration Server CCS 5 allows remote attackers to read the source code of JHTML files via URL encoded characters in the filename extension, as demonstrated by 1 changing .jhtml to %2Ejhtml, 2 changing .jhtml to .jhtm%6C, 3 appending %00 after .jhtml, and 4 appending %c0%80 after .jhtml,...
CVE-2004-1961
blocker.php in Protector System 1.15b1 allows remote attackers to bypass SQL injection protection and execute limited SQL commands via URL-encoded "'" characters "%27"...
KDE FTP KIOslave: Command injection
Background KDE is a feature-rich graphical desktop environment for Linux and Unix-like Operating Systems. KDE provided KIOslaves for many protocols in the kdelibs package, one of them being FTP. These are used by KDE applications such as Konqueror. Description The FTP KIOslave fails to properly...