CVE-2024-11695

A flaw in Mozilla software allows a crafted URL containing Arabic script and whitespace characters to hide the true origin of a page, potentially enabling a spoofing attack . This vulnerability affects Firefox versions < 133, Firefox ESR < 128.5, Thunderbird versions < 133, and Thunderbird

CVE-2022-37429

Silverstripe silverstripe/framework through 4.11 allows XSS issue 1 of 2 via JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters...

Stored XSS using HTMLEditor

A malicious content author could add a JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters. An attacker must have access to the CMS to exploit this issue...

Protocol/Hostname spoofing via Improper Input Validation

Description The uri.js doesn't remove whitespace characters from the beginning of the protocol, so it doesn't parse URLs properly. Several methods, including http.get, location.href, and fetch, strip the whitespace character in front of the protocol before sending the request. Proof of Concept...