CWE-173.

Ghost before 6.20.0 File Read via URL Encoding Bypass

• Ghost
• CWE-173

Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry

• CWE-173

>=0.1.0, <1.0.19 · fixed in 1.0.19

Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding

• Red Hat Build of Apache Camel 3.33.3.SP2
• Red Hat Build of Debezium 3.6
• CWE-173

Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

• Authentication bypass
• CWE-173

>=12.0.0, <12.0.36 || >=12.1.0, <12.1.10 · fixed in 12.0.36, 12.1.10

JetBrains YouTrack: In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack…

• JetBrains YouTrack
• CWE-173

Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially crafted input.

• CWE-173

<2.2.0 · fixed in 2.2.0

Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid UTF-8 characters as input.

• CWE-173

<2.2.0 · fixed in 2.2.0

node-fetch forwards secure headers to untrusted sites

• Information disclosure
• Open redirect

<2.6.7 || >=3.0.0, <3.1.1 · fixed in 2.6.7, 3.1.1

Information Disclosure in Guava

• Information disclosure
• Broken access control

<32.0.0-android · fixed in 32.0.0-android

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization.

• CWE-173