CVE-2022-3782

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. Thi...

Browsershot does not validate URL protocols passed to Browsershot URL method

Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method...

Design/Logic Flaw

Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method...

Ondisk Player 数据伪造问题漏洞

Ondisk Player is a player from the Korean company Ondisk. A security vulnerability exists in Ondisk Player versions prior to 1.3.9.19, which stems from insufficient validation of URLs, etc. A remote attacker can exploit this vulnerability to cause malicious code to be downloaded and executed by a...

CVE-2022-41706 Browsershot 3.57.2 - Server Side XSS to LFR via URL

Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method...

Cross-Site Scripting (XSS)

Concrete CMS is vulnerable to cross-site scripting. The vulnerability exists due to lack of url validation in the state parameter which allows a remote attacker to inject and execute malicious JavaScript on the target system...

CVE-2022-41215

SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation. This could lead to the user being tricked to disclose personal information...

CVE-2022-41215

SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation. This could lead to the user being tricked to disclose personal information...

CVE-2022-41215

SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation. This could lead to the user being tricked to disclose personal information...

CVE-2022-41215

CVE-2022-41215 affects SAP NetWeaver ABAP Server and ABAP Platform. The issue is an unauthenticated URL redirection caused by insufficient URL validation, potentially tricking users into disclosing personal information. The vulnerability is categorized with CVSSv3.1 base score 4.7 (Medium) and in...

CVE-2022-41215

SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation. This could lead to the user being tricked to disclose personal information...

DEBIAN-CVE-2022-39369

phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service CAS server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker to control the host header and use a...

phpCAS vulnerable to Service Hostname Discovery Exploitation

phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service CAS server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker to control the host header and use a...

Server side request forgery (ssrf)

The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it possible for authenticated users to ma...

PT-2024-4357

Name of the Vulnerable Software and Affected Versions PHP versions 8.1. through 8.1.28 PHP versions 8.2. through 8.2.19 PHP versions 8.3. through 8.3.7 Description A code logic error in PHP's filtering functions, such as filter var, when validating URLs with FILTER VALIDATE URL, can result in...

GHSA-CG8C-GC2J-2WF7 Flask-Security vulnerable to Open Redirect

This affects all versions of package Flask-Security. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only...

Flask-Security vulnerable to Open Redirect

This affects all versions of package Flask-Security. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only...

URL Redirection to Untrusted Site ('Open Redirect')

This affects all versions of package Flask-Security. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only...

Server-Side Request Forgery (SSRF)

labelstudio is vulnerable to server-side request forgery. The vulnerability exists in the loadtasks function in uploader.py because the library doesn't properly validate URLs in data import functionality, which allows an authenticated attacker to cause an ssrf bypass via a maliciously crafted URL...

Security Bulletin: Tivoli Federated Identity Manager and Tivoli Federated Identity Manager Business Gateway redirect to an insufficiently validated URL (CVE-2013-5431)

Abstract Under certain conditions, IBM Tivoli Federated Identity Manager TFIM/ IBM Tivoli Federated Identity Manager Business Gateway TFIMBG could send a redirect to a URL provided by an external client without performing sufficient validation of the URL Content VULNERABILITY DETAILS: CVE ID:...