Adeadfed

An issue was discovered in the custom implementation of a web server, available via the "zola serve" command, which allows directory traversal. The `handle request` function, used by the server to process HTTP requests, does not account for sequences of special path control characters (`../`) in the URL when serving a file, allowing one to escape the webroot of the server and read arbitrary files from the filesystem.

A dependency confusion in pipreqs allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server.

A vulnerabilidade permite que invasores remotos realizem ataques de phishing redirecionando usuários para sites controlados por eles por meio do parâmetro `returnUrl`. Esse parâmetro é processado por várias funções, incluindo a função `ChangePassword`, a função `SignInCustomerAsync`, o método `SuccessfulAuthentication` ou a classe `NopRedirectResultExecutor`.