CVE-2016-10514

urlcheckformat in include/functions.inc.php in Piwigo before 2.8.3 allows remote attackers to bypass intended access restrictions via a URL that contains a " character, or a URL beginning with a substring other than the http:// or https:// substring...

CVE-2017-9804

In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this...

Brave Software: Homograph Attack Bypass [ Tested on Linux & Windows ]

Summary: at 175286 you has been patched, and i try it work, but i've another way to bypass it. when we add a site to our Homepage with @, it's not validate a url properly, make sure it's display the punycode. Products affected: Brave 0.18.36 Linux & Windows Steps To Reproduce: 1. In browser add...

GSA Bounty: Homo graphs attack

Hi there, Greeting for the day, hope you are doing good, In Federa localhost i found homograph attack, Here i made homograph for the ebay.com, when see this link its look like normal simple text link but no its not, however, when you click on this particular link you might be think that you are...

BSA-2017-428

Security Advisory ID : BSA-2017-428 Component : Apache Struts Revision : 2.0: Interim The previous fix issued with CVE-2017-7672 was incomplete. If an application allows enter an URL in a form field and built-inURLValidatoris used, it is possible to prepare a special URL which will be used to...

Denial Of Service (DoS)

Struts-core is vulnerable to denial of service DoS attacks. A malicious user can pass a URL string to the application to overload the URL validation process, preventing other strings from being validated...

CVE-2017-7672

If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12...

CVE-2017-7672

If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12...

[SECURITY] [DSA 3897-1] drupal7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3897-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 24, 2017 https://www.debian.org/security/faq -...

Debian DSA-3815-1 : wordpress - security update

Several vulnerabilities were discovered in wordpress, a web blogging tool. They would allow remote attackers to delete unintended files, mount Cross-Site Scripting attacks, or bypass redirect URL validation mechanisms. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

[SECURITY] [DSA 3815-1] wordpress security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3815-1 [email protected] https://www.debian.org/security/ Sebastien Delafond March 23, 2017 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3815-1 (wordpress - security update)

Several vulnerabilities were discovered in wordpress, a web blogging tool. They would allow remote attackers to delete unintended files, mount Cross-Site Scripting attacks, or bypass redirect URL validation mechanisms. OpenVAS Vulnerability Test $Id: deb3815.nasl 6607 2017-07-07 12:04:25Z cfische...

[SECURITY] [DLA 860-1] wordpress security update

Package : wordpress Version : 3.6.1+dfsg-1deb7u14 CVE ID : CVE-2017-6814 CVE-2017-6815 CVE-2017-6816 Debian Bug : 857026 Several vulnerabilities were discovered in wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following issues. CVE-2017-6814...

HackerOne: IE 11 Self-XSS on Jira Integration Preview Base Link

I wasn't sure if you would accept this report due to it being Self-XSS, but I figured it might be useful information because it breaks one of the flows used to validate URLs. Steps ==================== 1. Launch IE 11 2. Log into a HackerOne account that has admin on a program. 3. Go to the...

DEBIAN-CVE-2017-6815

In WordPress before 4.7.3 wp-includes/pluggable.php, control characters can trick redirect URL validation...

CVE-2017-6815

In WordPress before 4.7.3 wp-includes/pluggable.php, control characters can trick redirect URL validation...

CVE-2017-6815

In WordPress before 4.7.3 wp-includes/pluggable.php, control characters can trick redirect URL validation...

CVE-2017-6815

WordPress before 4.7.3 (wp-includes/pluggable.php) is affected by CVE-2017-6815. The vulnerability arises from a control-character input that bypasses redirect URL validation, allowing an unauthenticated, remote attacker to craft a link that redirects a user to an arbitrary site. A fix is availab...

WordPress Multiple Vulnerabilities (Mar 2017) - Windows

WordPress is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescripti...

WordPress Multiple Vulnerabilities (Mar 2017) - Linux

WordPress is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescripti...