PT-2020-16207

Name of the Vulnerable Software and Affected Versions Tiny Tiny RSS tt-rss versions prior to 2020-09-16 Description The issue is related to the failure of Tiny Tiny RSS to validate all URLs before requesting them. This could potentially lead to unauthorized access or other security issues...

jenkins-subversion-plugin: XSS in project repository base url

Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field form validation, resulting in a stored cross-site scripting vulnerability...

CVE-2020-1890

A URL validation issue in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have caused the recipient of a sticker message containing deliberately malformed data to load an image from a sender-controlled URL without user interaction...

Input validation

A URL validation issue in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have caused the recipient of a sticker message containing deliberately malformed data to load an image from a sender-controlled URL without user interaction...

CVE-2020-1890

CVE-2020-1890 describes a URL-validation issue in WhatsApp for Android (pre v2.20.11) and WhatsApp Business for Android (pre v2.20.2). The root cause is improper URL validation in sticker messages containing deliberately malformed data, which could cause a recipient to load an image from a sender...

CVE-2020-1890

A URL validation issue in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have caused the recipient of a sticker message containing deliberately malformed data to load an image from a sender-controlled URL without user interaction...

CVE-2020-25019

CVE-2020-25019 affects jitsi-meet-electron (Jitsi Meet Electron) up to version 2.3.0. The vulnerability arises when the Electron shell.openExternal function is invoked without verifying that the target URL is http or https, in certain circumstances. Impact details are not fully elaborated in the ...

CVE-2020-17386

Cellopoint Cellos/CelloOS vulnerability CVE-2020-17386: improper validation of URL input allows an authenticated user to tamper with a URL parameter via cookies and access arbitrary files on the system (SSRF). Affected product/version: Cellopoint CelloOS/Cellos v4.1.10 Build 20190922. Impact indi...

CVE-2020-17386 Cellopoint CelloOS - Server-Side Request Forgery (SSRF)

Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly. With cookie of an authenticated user, attackers can temper with the URL parameter and access arbitrary file on system...

PT-2020-5867 · Php +9 · Php +9

Name of the Vulnerable Software and Affected Versions: PHP versions 7.3.x through 7.3.25 PHP versions 7.4.x through 7.4.13 PHP version 8.0.0 Description: The issue is related to insufficient input validation in PHP's URL validation functions, such as filter var$url, FILTER VALIDATE URL. This allo...

jenkins-subversion-plugin: XSS in project repository base url

Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field form validation, resulting in a stored cross-site scripting vulnerability...

Denial of Service in gajus/url-regexp

Overview RegExp object to match and validate URLs. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS. An attacker providing a long URL to validate or replace function will cause a Denial of Service attack. PoC node var regex = require"url-regexp";...

Denial of Service in nescalante/urlregex

Overview urlregex No-dependency URL validation for Node and the browser. This package is vulnerable to Regular Expression Denial of Service ReDoS. An attacker providing a long string in String.test can cause a Denial of Service attack. PoC node const urlRegex = require"urlregex"; const isValid =...

CVE-2020-6266

SAP Fiori for SAP S/4HANA, versions - 100, 200, 300, 400, allows an attacker to redirect users to a malicious site due to insufficient URL validation, leading to URL Redirection...

Input validation

SAP Fiori for SAP S/4HANA, versions - 100, 200, 300, 400, allows an attacker to redirect users to a malicious site due to insufficient URL validation, leading to URL Redirection...

CVE-2020-6266

The CVE-2020-6266 entry affects SAP Fiori for SAP S/4HANA, versions 100–400. The underlying issue is insufficient URL validation that enables an attacker to redirect users to a malicious site. The exposed component/behavior is URL redirection via manipulated links. Publicly visible remediation de...

Password Reset Landing Page (PRLP) - Highly critical - Access bypass - SA-CONTRIB-2020-021

This module enables you to force a password update when using password reset link. The module doesn't sufficiently validate the login URL allowing a malicious user to use a specially crafted URL to log in as another user...

Open Redirection

httpd is vulnerable to open redirection. The modrewrite configurations is vulnerable to open redirect due to lack of validation in the URL...

CVE-2020-11053

In OAuth2 Proxy before 5.1.1, there is an open redirect vulnerability. Users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is check...

The vulnerability of the WordPress website content management system, related to server-side query manipulation, allows attackers to access sensitive data, compromise its integrity, and cause service interruptions.

The vulnerability of the WordPress website content management system is related to the SSRF request manipulation. This is because URL validation does not consider the interpretation of the name as a sequence of hexadecimal characters. Exploiting this vulnerability can allow an attacker to gain...