CVE-2021-23393

This affects the package Flask-Unchained before 0.9.0. When using the the validateredirecturl function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only exploitable if an...

Input validation

This affects the package Flask-Unchained before 0.9.0. When using the the validateredirecturl function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only exploitable if an...

PYSEC-2021-96

This affects the package Flask-Unchained before 0.9.0. When using the the validateredirecturl function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only exploitable if an...

CVE-2021-23393

This affects the package Flask-Unchained before 0.9.0. When using the the validateredirecturl function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only exploitable if an...

CVE-2021-23393 Open Redirect

This affects the package Flask-Unchained before 0.9.0. When using the the validateredirecturl function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only exploitable if an...

CVE-2021-23393

Vulnerability: Flask-Unchained before 0.9.0 has an open redirect via the _validate_redirect_url function. Providing multiple backslashes (e.g., \\evil.com/path) can bypass URL validation and redirect users to an arbitrary URL. Conditions: Exploitation is possible only if an alternative WSGI serve...

PT-2021-15487

Name of the Vulnerable Software and Affected Versions Flask-Unchained versions prior to 0.9.0 Description The issue allows bypassing URL validation and redirecting a user to an arbitrary URL by providing multiple back slashes, such as evil.com/path, when using the validate redirect url function...

Cisco Webex Meetings and Webex Meetings Server File Redirect Vulnerability

A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to redirect users to a malicious file. This vulnerability is due to improper validation of URL paths in the application interface. An attacker could exploit this vulnerability b...

Khan Academy: Bypass the fix of report #1078283 due to poor validation

Hi Khan Academy Team, I was able to bypass the fix you implemented for report 1078283. The URL validation you implemented on the endpoint continue checks the presence of khanacademy.org however it doesn't have any boundary checking to ignore domains starting with .org, so if an attacker register ...

Open Redirection

hyn/multi-tenant is vulnerable to open redirection. Lack of URL validation allows an attacker to redirect users to a malicious site...

Open redirect

Tenancy multi-tenant is an open source multi-domain controller for the Laravel web framework. In some situations, it is possible to have open redirects where users can be redirected from your site to any other site using a specially crafted URL. This is only the case for installations where the...

Nextcloud Desktop Client: User-assisted execution of arbitrary code

Background The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. Description It was discovered that Nextcloud Desktop Client did not validate URLs. Impact A remote attacker could entice a user to connect to a malicious Nextcloud server to cause the...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This...

CVE-2021-32618

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is an independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. All versions of Flask-Security-Too allow redirects after many successful views e....

Cross site scripting

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is an independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. All versions of Flask-Security-Too allow redirects after many successful views e....

CVE-2021-32618 Open Redirect Vulnerability

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is an independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. All versions of Flask-Security-Too allow redirects after many successful views e....

Open Redirect in Flask-Security-Too

Flask-Security allows redirects after many successful views e.g. /login by honoring the ?next query param. There is code in FS to validate that the url specified in the next parameter is either relative OR has the same netloc network location as the requesting URL. This check utilizes Pythons...

Open Redirect

Overview Flask-Unchained is a The quickest and easiest way to build large web apps and APIs with Flask and SQLAlchemy Affected versions of this package are vulnerable to Open Redirect. When using the the validateredirecturl function, it is possible to bypass URL validation and redirect a user to ...

Cross-site Scripting (XSS) - Reflected in bustle/mobiledoc-kit

✍️ Description XSS using bypass of url validation 🕵️‍♂️ Proof of Concept i see your code https://github.com/bustle/mobiledoc-kit uses a dependance https://github.com/bustle/mobiledoc-dom-renderer . This dependency uses for url validation to prevent xss . It filter javascript,vbscript protocol to...

Huawei EulerOS: Security Advisory for php (EulerOS-SA-2021-1830)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...