CVE-2021-23393 Open Redirect

This affects the package Flask-Unchained before 0.9.0. When using the the validateredirecturl function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only exploitable if an...

CVE-2021-23393

This affects the package Flask-Unchained before 0.9.0. When using the the validateredirecturl function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only exploitable if an...

DEBIAN-CVE-2019-17567

Apache HTTP Server versions 2.4.6 to 2.4.46 modproxywstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP validation, authenticati...

PT-2021-15487

Name of the Vulnerable Software and Affected Versions Flask-Unchained versions prior to 0.9.0 Description The issue allows bypassing URL validation and redirecting a user to an arbitrary URL by providing multiple back slashes, such as evil.com/path, when using the validate redirect url function...

CVE-2021-23393: URL Redirection to Untrusted Site

This affects the package Flask-Unchained before 0.9.0. When using the the validateredirecturl function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only exploitable if an...

Flask-Unchained 输入验证错误漏洞

Flask-Unchained is an open source Flask extension, a pluggable application factory, and a set of optional "packages" that together create a modern, fully integrated, and highly customizable web framework for Flask and its ecosystem of extensions. A security vulnerability exists in Flask-Unchained...

SilverStripe 输入验证错误漏洞

Silverstripe SilverStripe is New Zealand SilverStripe Silverstripe company's set of open source programming framework and content management system CMS. The system has support for multiple languages , cross-platform and other features . SilverStripe has a security vulnerability that stems from a...

PT-2021-11214 · Silverstripe · Silverstripe

Name of the Vulnerable Software and Affected Versions: SilverStripe versions prior to 4.6.0-rc1 Description: The issue arises when a FormField with square brackets in the field name is used, causing it to skip validation. Specifically, the FileField class, commonly used for file upload, can be...

CVE-2020-36141

BloofoxCMS 0.5.2.1 allows Unrestricted File Upload vulnerability via bypass MIME Type validation by inserting 'image/jpeg' within the 'Content-Type' header...

CVE-2021-33054

SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. Only versions after 2.0.5a are affected...

CVE-2020-36141: Unrestricted Upload of File with Dangerous Type

BloofoxCMS 0.5.2.1 allows Unrestricted File Upload vulnerability via bypass MIME Type validation by inserting 'image/jpeg' within the 'Content-Type' header...

CVE-2021-24012

An improper following of a certificate's chain of trust vulnerability in FortiGate versions 6.4.0 to 6.4.4 may allow an LDAP user to connect to SSLVPN with any certificate that is signed by a trusted Certificate Authority...

Cross site request forgery (csrf)

The Content Copy Protection & Prevent Image Save WordPress plugin through 1.3 does not check for CSRF when saving its settings, not perform any validation and sanitisation on them, allowing attackers to make a logged in administrator set arbitrary XSS payloads in them...

Signature Validation Bypass

Impact An authentication bypass exists in the goxmldsig this library uses to determine if SAML assertions are genuine. An attacker could craft a SAML response that would appear to be valid but would not have been genuinely issued by the IDP. Patches Version 0.4.2 bumps the dependency which should...

PT-2021-24382

Name of the Vulnerable Software and Affected Versions: gosaml2 versions prior to 0.5.0 Description: Given a valid SAML Response, an attacker can potentially modify the document, bypassing signature validation in order to pass off the altered document as a signed one. This enables a variety of...

PT-2021-5806

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.6 through 2.4.46 Description The issue is related to the handling of HTTP requests in the Apache HTTP Server. Specifically, when mod proxy wstunnel is configured on a URL that is not necessarily upgraded by the...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This...

Validation bypass in jpv

jpv aka Json Pattern Validator before 2.2.2 does not properly validate input, as demonstrated by a corrupted array...

GHSA-VH6R-G38F-Q3W8 Validation bypass in jpv

jpv aka Json Pattern Validator before 2.2.2 does not properly validate input, as demonstrated by a corrupted array...

CVE-2021-26804

Insecure Permissions in Centreon Web versions 19.10.18, 20.04.8, and 20.10.2 allows remote attackers to bypass validation by changing any file extension to ".gif", then uploading it in the "Administration/ Parameters/ Images" section of the application...