Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-15108 State: PUBLISHED Published: 2020-07-17T20:30:17 Last Updated: 2024-08-04T13:08:21.741Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-89 Description: In glpi before 9.5.1, there is a SQL injection for all usages of "Clone" feature. This has been fixed in 9.5.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-qv6w-68gq-wx2v - https://github.com/glpi-project/glpi/pull/6684 - https://github.com/glpi-project/glpi/commit/a4baa64114eb92fd2adf6056a36e0582324414ba
CVE ID: CVE-2020-15109 State: PUBLISHED Published: 2020-08-04T23:00:16 Last Updated: 2024-08-04T13:08:21.891Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: solidusio Products: solidus Problem Types: CWE-20 Description: In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. Th
the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted. See the linked reference for more information. As a workaround, if it is not possible to upgrade to a supported patched version, please use this gist in the references section. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7ph - https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bd
olidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7ph - https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d
CVE ID: CVE-2020-15110 State: PUBLISHED Published: 2020-07-17T20:45:13 Last Updated: 2024-08-04T13:08:22.300Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: jupyterhub Products: kubespawner Problem Types: CWE-863 Description: In jupyterhub-kubespawner before 0.12, certain usernames will be able to craft particular server names which will grant them access to the default server of other users who have matching usernames. This has been fixed in 0.12. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jupyterhub/kubespawner/security/advisories/GHSA-v7m9-9497-p9gr - https://github.com/jupyterhub/kubespawner/commit/3dfe870a7f5e98
ub/kubespawner/security/advisories/GHSA-v7m9-9497-p9gr - https://github.com/jupyterhub/kubespawner/commit/3dfe870a7f5e98e2e398b01996ca6b8eff4bb1d0
CVE ID: CVE-2020-15111 State: PUBLISHED Published: 2020-07-20T17:40:14 Last Updated: 2024-08-04T13:08:21.646Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: gofiber Products: fiber Problem Types: CWE-74, CWE-93 Description: In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an attacker could upload a custom filename and then give the link to the victim. With this filename, the attacker can change the name of the downloaded file, redirect to another site, change the authorization header, etc. A possible workaround is t
name of the downloaded file, redirect to another site, change the authorization header, etc. A possible workaround is to serialize the input before passing it to ctx.Attachment(). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gofiber/fiber/security/advisories/GHSA-9cx9-x2gp-9qvh - https://github.com/gofiber/fiber/pull/579/commits/f698b5d5066cfe594102ae252cd58a1fe57cf56f
CVE ID: CVE-2020-15112 State: PUBLISHED Published: 2020-08-05T20:00:15 Last Updated: 2024-08-04T13:08:22.313Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: etcd-io Products: etcd Problem Types: CWE-20 Description: In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/etcd-io/etcd/security/advisories/GHSA-
ditional Analyst Notes: - CVE Program Container: References: - https://github.com/etcd-io/etcd/security/advisories/GHSA-m332-53r6-2w93 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/
CVE ID: CVE-2020-15113 State: PUBLISHED Published: 2020-08-05T19:30:13 Last Updated: 2024-08-04T13:08:22.262Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: etcd-io Products: etcd Problem Types: CWE-281 Description: In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created (etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS connections with clients) with restricted access permissions (700) by using the os.MkdirAll. This function does not perform any permission checks when a given directory path exists already. A possible workaround is to ensure the directories have the des
ssion checks when a given directory path exists already. A possible workaround is to ensure the directories have the desired permission (700). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/etcd-io/etcd/security/advisories/GHSA-chh6-ppwq-jh92 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/
CVE ID: CVE-2020-15114 State: PUBLISHED Published: 2020-08-06T22:25:12 Last Updated: 2024-08-04T13:08:21.664Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: etcd-io Products: etcd Problem Types: CWE-400 Description: In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway. Additional Analyst Notes: - CVE Program Container: Refer
vailable file descriptors to accept connections on the gateway. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/etcd-io/etcd/security/advisories/GHSA-2xhq-gv6c-p224 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/
CVE ID: CVE-2020-15115 State: PUBLISHED Published: 2020-08-06T21:55:12 Last Updated: 2024-08-04T13:08:21.734Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: etcd-io Products: etcd Problem Types: CWE-521 Description: etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational effort. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/etcd-io/etcd/security/advisories/GHSA-4993-m7g5-r9hh - https://lists.fedoraproject.org/archives/list
https://github.com/etcd-io/etcd/security/advisories/GHSA-4993-m7g5-r9hh - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/
CVE ID: CVE-2020-15117 State: PUBLISHED Published: 2020-07-15T17:25:14 Last Updated: 2024-08-04T13:08:21.956Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: symless Products: synergy-core Problem Types: CWE-755 Description: In Synergy before version 1.12.0, a Synergy server can be crashed by receiving a kMsgHelloBack packet with a client name length set to 0xffffffff (4294967295) if the servers memory is less than 4 GB. It was verified that this issue does not cause a crash through the exception handler if the available memory of the Server is more than 4GB. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/symless/synergy-
r is more than 4GB. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/symless/synergy-core/security/advisories/GHSA-chfm-333q-gfpp - https://github.com/symless/synergy-core/commit/0a97c2be0da2d0df25cb86dfd642429e7a8bea39 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VFDEQED64YLWQK2TF73EMXZDYX7YT2DD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAQYCMBWNVCIEM27NPIKK3DGJCNBYLAK/
CVE ID: CVE-2020-15118 State: PUBLISHED Published: 2020-07-20T17:50:16 Last Updated: 2024-08-04T13:08:21.683Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: wagtail Products: wagtail Problem Types: CWE-79 Description: In Wagtail before versions 2.7.4 and 2.9.3, when a form page type is made available to Wagtail editors through the `wagtail.contrib.forms` app, and the page template is built using Django's standard form rendering helpers such as form.as_p, any HTML tags used within a form field's help text will be rendered unescaped in the page. Allowing HTML within help text is an intentional design decision by Django; however, as a matter of policy Wagtail
age. Allowing HTML within help text is an intentional design decision by Django; however, as a matter of policy Wagtail does not allow editors to insert arbitrary HTML by default, as this could potentially be used to carry out cross-site scripting attacks, including privilege escalation. This functionality should therefore not have been made available to editor-level users. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patched versions have been released as Wagtail 2.7.4 (for the LTS 2.7 branch) and Wagtail 2.9.3 (for the current 2.9 branch). In these versions, help text will be escaped to prevent the inclusion of HTML tags. Site owners
the current 2.9 branch). In these versions, help text will be escaped to prevent the inclusion of HTML tags. Site owners who wish to re-enable the use of HTML within help text (and are willing to accept the risk of this being exploited by editors) may set WAGTAILFORMS_HELP_TEXT_ALLOW_HTML = True in their configuration settings. Site owners who are unable to upgrade to the new versions can secure their form page templates by rendering forms field-by-field as per Django's documentation, but omitting the |safe filter when outputting the help text. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wagtail/wagtail/security/advisories/GHSA-2473-9hgq-j7xw - https:/
VE Program Container: References: - https://github.com/wagtail/wagtail/security/advisories/GHSA-2473-9hgq-j7xw - https://docs.djangoproject.com/en/3.0/ref/models/fields/#django.db.models.Field.help_text - https://docs.wagtail.io/en/stable/reference/contrib/forms/index.html#usage - https://github.com/wagtail/wagtail/commit/d9a41e7f24d08c024acc9a3094940199df94db34 - https://github.com/wagtail/wagtail/blob/master/docs/releases/2.9.3.rst
CVE ID: CVE-2020-15119 State: PUBLISHED Published: 2020-08-19T21:20:11 Last Updated: 2024-08-04T13:08:21.963Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: auth0 Products: lock Problem Types: CWE-79 Description: In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting (XSS) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/auth0/lock/security/advisories/GHSA-6gg3-pmm7-97xc
CVE ID: CVE-2020-15120 State: PUBLISHED Published: 2020-07-27T17:50:12 Last Updated: 2024-08-04T13:08:21.957Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: spiral-project Products: ihatemoney Problem Types: CWE-863 Description: In "I hate money" before version 4.1.5, an authenticated member of one project can modify and delete members of another project, without knowledge of this other project's private code. This can be further exploited to access all bills of another project without knowledge of this other project's private code. With the default configuration, anybody is allowed to create a new project. An attacker can create a new project and then use
he default configuration, anybody is allowed to create a new project. An attacker can create a new project and then use it to become authenticated and exploit this flaw. As such, the exposure is similar to an unauthenticated attack, because it is trivial to become authenticated. This is fixed in version 4.1.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/spiral-project/ihatemoney/security/advisories/GHSA-67j9-c52g-w2q9 - https://github.com/spiral-project/ihatemoney/commit/8d77cf5d5646e1d2d8ded13f0660638f57e98471
CVE ID: CVE-2020-15121 State: PUBLISHED Published: 2020-07-20T18:00:25 Last Updated: 2024-08-04T13:08:21.976Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N) Vendors: radareorg Products: radare2 Problem Types: CWE-78 Description: In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection. To trigger the problem it's required to open the executable in radare2 and run idpd to trigger the download. The shell code will execute, and will create a file called pwned in the current directory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radareorg/radare2/security/advisories/GHSA-r552-vp94-9358 -
s: - CVE Program Container: References: - https://github.com/radareorg/radare2/security/advisories/GHSA-r552-vp94-9358 - https://github.com/radareorg/radare2/issues/16945 - https://github.com/radareorg/radare2/pull/16966 - https://github.com/radareorg/radare2/commit/04edfa82c1f3fa2bc3621ccdad2f93bdbf00e4f9 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YE77P5RSE2T7JHEKMWF2ARTSJGMPXCFY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWC7KNBETYE5MK6VIUU26LUIISIFGSBZ/
CVE ID: CVE-2020-15123 State: PUBLISHED Published: 2020-07-20T17:20:16 Last Updated: 2024-08-04T13:08:21.863Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: codecov Products: codecov-node Problem Types: CWE-78 Description: In codecov (npm package) before version 3.7.1 the upload method has a command injection vulnerability. Clients of the codecov-node library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. A similar CVE (CVE-2020-7597 for GHSA-5q88-cjfq-g2mh) was issued but the fix was incomplete. It only blocked &, and command injection is still possible using backticks instead to bypass the sanitizer
s incomplete. It only blocked &, and command injection is still possible using backticks instead to bypass the sanitizer. The attack surface is low in this case. Particularly in the standard use of codecov, where the module is used directly in a build pipeline, not built against as a library in another application that may supply malicious input and perform command injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/codecov/codecov-node/security/advisories/GHSA-xp63-6vf5-xf3v - https://github.com/codecov/codecov-node/pull/180 - https://github.com/codecov/codecov-node/commit/c0711c656686e902af2cd92d6aecc8074de4d83d - https://github.com/advisories/GHS
ps://github.com/codecov/codecov-node/commit/c0711c656686e902af2cd92d6aecc8074de4d83d - https://github.com/advisories/GHSA-5q88-cjfq-g2mh - https://lgtm.com/query/7714424068617023832
CVE ID: CVE-2020-15124 State: PUBLISHED Published: 2020-07-22T17:35:13 Last Updated: 2024-08-04T13:08:21.787Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: intranda Products: goobi-viewer-core Problem Types: CWE-22 Description: In Goobi Viewer Core before version 4.8.3, a path traversal vulnerability allows for remote attackers to access files on the server via the application. This is limited to files accessible to the application server user, eg. tomcat, but can potentially lead to the disclosure of sensitive information. The vulnerability has been fixed in version 4.8.3 Additional Analyst Notes: - CVE Program Container: References: - https://github.co
ility has been fixed in version 4.8.3 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-7gwq-xqw3-cr63 - https://github.com/intranda/goobi-viewer-core/commit/44ceb8e2e7e888391e8a941127171d6366770df3
CVE ID: CVE-2020-15125 State: PUBLISHED Published: 2020-07-29T16:25:15 Last Updated: 2024-08-04T13:08:22.304Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: auth0 Products: node-auth0 Problem Types: CWE-209 Description: In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer token. You are affected by this vulnerability if you are using the auth0 npm package, and you are using a Machine to Machine application authorized to
s vulnerability if you are using the auth0 npm package, and you are using a Machine to Machine application authorized to use Auth0's management API Additional Analyst Notes: - CVE Program Container: References: - https://github.com/auth0/node-auth0/security/advisories/GHSA-5jpf-pj32-xx53 - https://github.com/auth0/node-auth0/pull/507 - https://github.com/auth0/node-auth0/pull/507/commits/62ca61b3348ec8e74d7d00358661af1a8bc98a3c - https://github.com/auth0/node-auth0/tree/v2.27.1
CVE ID: CVE-2020-15126 State: PUBLISHED Published: 2020-07-22T23:05:19 Last Updated: 2024-08-04T13:08:22.292Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: parse-community Products: parse-server Problem Types: CWE-863 Description: In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/parse-community/parse-server/security/advisories/GHSA-236h-rqv8-8q73 - https://github.com/parse-community/par
github.com/parse-community/parse-server/security/advisories/GHSA-236h-rqv8-8q73 - https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa - https://github.com/parse-community/parse-server/blob/master/CHANGELOG.md#430
CVE ID: CVE-2020-15127 State: PUBLISHED Published: 2020-08-05T20:15:14 Last Updated: 2024-08-04T13:08:21.952Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: projectcontour Products: contour Problem Types: CWE-306 Description: In Contour ( Ingress controller for Kubernetes) before version 1.7.0, a bad actor can shut down all instances of Envoy, essentially killing the entire ingress data plane. GET requests to /shutdown on port 8090 of the Envoy pod initiate Envoy's shutdown procedure. The shutdown procedure includes flipping the readiness endpoint to false, which removes Envoy from the routing pool. When running Envoy (For example on the host network, pod spe
dpoint to false, which removes Envoy from the routing pool. When running Envoy (For example on the host network, pod spec hostNetwork=true), the shutdown manager's endpoint is accessible to anyone on the network that can reach the Kubernetes node that's running Envoy. There is no authentication in place that prevents a rogue actor on the network from shutting down Envoy via the shutdown manager endpoint. Successful exploitation of this issue will lead to bad actors shutting down all instances of Envoy, essentially killing the entire ingress data plane. This is fixed in version 1.7.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projectcontour/contour/se
ion 1.7.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projectcontour/contour/security/advisories/GHSA-mjp8-x484-pm3r - https://github.com/projectcontour/contour/releases/tag/v1.7.0
CVE ID: CVE-2020-15128 State: PUBLISHED Published: 2020-07-31T17:45:20 Last Updated: 2024-08-04T13:08:22.316Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N) Vendors: octobercms Products: october Problem Types: CWE-565 Description: In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing code (nothing exploitable in the core project itself) had a higher chance of succeeding. Specifically, if your usage exposed a way for users to provide unfiltered user input and have it returned to them
ding. Specifically, if your usage exposed a way for users to provide unfiltered user input and have it returned to them as an encrypted cookie (ex. storing a user provided search query in a cookie) they could then use the generated cookie in place of other more tightly controlled cookies; or if your usage exposed the plaintext version of an encrypted cookie at any point to the user they could theoretically provide encrypted content from your application back to it as an encrypted cookie and force the framework to decrypt it for them. Issue has been fixed in build 468 (v1.0.468). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/octobercms/october/security/ad
468). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/octobercms/october/security/advisories/GHSA-55mm-5399-7r63 - https://github.com/octobercms/library/pull/508 - https://github.com/octobercms/library/commit/28310d4fb336a1741b39498f4474497644a6875c
CVE ID: CVE-2020-15129 State: PUBLISHED Published: 2020-07-30T15:20:15 Last Updated: 2024-08-04T13:08:22.414Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N) Vendors: containous Products: traefik Problem Types: CWE-601 Description: In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik's handling of the "X-Forwarded-Prefix" header. The Traefik API dashboard component doesn't validate that the value of the header "X-Forwarded-Prefix" is a site relative path and will redirect to any header provided URI. Successful exploitation of an open redirect can be used to entice victims to disclose sensitive inform