CVE-2021-33193

A crafted method sent through HTTP/2 will bypass validation and be forwarded by modproxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48...

CVE-2021-1110

NVIDIA Linux kernel distributions on Jetson Xavier contain a vulnerability in camera firmware where a user can change input data after validation, which may lead to complete denial of service and serious data corruption of all kernel components...

CVE-2021-22552 Memory overread secure enclave in Asylo 0.6.2

An untrusted memory read vulnerability in Asylo versions up to 0.6.1 allows an untrusted attacker to pass a syscall number in MessageReader that is then used by sysno and can bypass validation. This can allow the attacker to read memory from within the secure enclave. We recommend updating to Asy...

CVE-2021-22552

The CVE-2021-22552 entry concerns Google Asylo up to version 0.6.1, where an untrusted memory read vulnerability exists. The issue arises when an attacker can pass a syscall number in MessageReader, which is then used by sysno() and can bypass validation, enabling memory reads from within the sec...

mod_auth_mellon -- Redirect URL validation bypass

Jakub Hrozek reports: Version 0.17.0 and older of modauthmellon allows the redirect URL validation to be bypassed by specifying an URL formatted as ///fishing-site.example.com/logout.html...

CVE-2021-20110

Due to Manage Engine Asset Explorer Agent 1.0.34 not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Explorer's Server IP address. This will allow an attacker to send a NEWSCAN request to a listening agent on the network as we...

Input validation

IBM Security Verify Access Docker 10.0.0 could allow an authenticated user to bypass input due to improper input validation. IBM X-Force ID: 197966...

CVE-2021-20496

IBM Security Verify Access Docker 10.0.0 could allow an authenticated user to bypass input due to improper input validation. IBM X-Force ID: 197966...

PYSEC-2021-337

This affects all versions of package Flask-User. When using the makesafeurl function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as /////evil.com/path or \\\evil.com/path. This vulnerability is only exploitable if an...

Hewlett Packard Enterprise BackBox 授权问题漏洞

Hewlett Packard Enterprise BackBox is a U.S. Hewlett Packard Enterprise provides the functionality needed to deploy HPE Uninterruptible BackBox products into your backup and recovery operations. Hewlett Packard Enterprise BACKBOX There is an authorization issue vulnerability that stems from the...

Validation Bypass

neos/form has validation bypass. An attacker is able to input a malicious crafted 'GET' request and bypass invoking any validators...

CVE-2021-32697

The CVE-2021-32697 issue affects the Neos Form framework (neos/forms) where a crafted GET request with a valid form state can submit a form without triggering validators. The form state is protected by an HMAC that is still verified, so exploitation requires that Form Finishers may run actions ev...

USN-4993-1 dovecot vulnerabilities

Kirin discovered that Dovecot incorrectly escaped kid and azp fields in JWT tokens. A local attacker could possibly use this issue to validate tokens using arbitrary keys. This issue only affected Ubuntu 20.10 and Ubuntu 21.04. CVE-2021-29157 Fabian Ising and Damian Poddebniak discovered that...

Open redirect in Flask-Unchained

This affects the package Flask-Unchained before 0.9.0. When using the the validateredirecturl function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only exploitable if an...

Open Redirect

Overview Flask-User is a Customizable User Authorization & User Management: Register, Confirm, Login, Change username/password, Forgot password and more. Affected versions of this package are vulnerable to Open Redirect. When using the makesafeurl function, it is possible to bypass URL validation...

CVE-2021-23393

This affects the package Flask-Unchained before 0.9.0. When using the the validateredirecturl function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only exploitable if an...

PYSEC-2021-96

This affects the package Flask-Unchained before 0.9.0. When using the the validateredirecturl function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an...

CVE-2021-23393 Open Redirect

This affects the package Flask-Unchained before 0.9.0. When using the the validateredirecturl function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only exploitable if an...

DEBIAN-CVE-2019-17567

Apache HTTP Server versions 2.4.6 to 2.4.46 modproxywstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP validation, authenticati...

Flask-Unchained 输入验证错误漏洞

Flask-Unchained is an open source Flask extension, a pluggable application factory, and a set of optional "packages" that together create a modern, fully integrated, and highly customizable web framework for Flask and its ecosystem of extensions. A security vulnerability exists in Flask-Unchained...