393 matches found
CVE-2024-22243
CVE-2024-22243 Autor: Sean Pesce Este proyecto contiene una aplicación web de ejemplo que demuestra escenarios explotables para CVE-2024-22243, una vulnerabilidad de análisis de URL en el Spring Framework de Java divulgación oficial aquí. Vulnerabilidad Las versiones afectadas de Spring analizan ...
CVE-2026-35030-PoC
CVE-2026-35030 — Bypass de autenticación en LiteLLM mediante colisión de clave de caché de userinfo OIDC LiteLLM utiliza token:20 como clave de la caché de userinfo OIDC. Dos JWTs distintos firmados con el mismo algoritmo producen los primeros 20 caracteres idénticos , lo que permite a un atacant...
CVE-2026-100717
The froxlor server administration panel (versions 2.3.10 and earlier ) contains a CRLF injection vulnerability. The Validate::validateUrl component fails to inspect the userinfo (user:pass@) portion of a URL for carriage return and line feed characters. An authenticated low-privilege customer wit...
CVE-2026-100717 froxlor before 2.3.12 CRLF Injection via validateUrl userinfo
froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and fragment components returned by parseurl, and never inspects the userinfo user:pass@ components. This is an incomplete fix f...
CVE-2026-91134
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origin iframe to bypass the allowediframes prefix policy when the iframe src contained encoded userinfo. The sanitizer validated a decoded form...
CVE-2026-91134 Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origin iframe to bypass the allowediframes prefix policy when the iframe src contained encoded userinfo. The sanitizer validated a decoded form...
CVE-2026-91134
The open-source discussion platform Discourse contains a vulnerability in its post sanitizer prior to versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0 . The root cause is a logic flaw where the sanitizer validates a decoded form of an iframe src differently than how the browser interprets it. ...
CVE-2026-91134 Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origin iframe to bypass the allowediframes prefix policy when the iframe src contained encoded userinfo. The sanitizer validated a decoded form...
CVE-2026-56739 Logto: SSRF via Webhooks and Custom OAuth2 Connector UserInfo Endpoint
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.43.0, Logto fetches administrator-controlled outbound destinations without validating the address used for the connection. Webhook delivery in packages/core/src/libraries/hook/utils.ts can reach special-use and...
CVE-2026-91134: Improper Input Validation
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origin iframe to bypass the allowediframes prefix policy when the iframe src contained encoded userinfo. The sanitizer validated a decoded form...
EUVD-2026-83953
GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control material URLs through several read-only APIs available to regular authenticated users. Although GoCD recommends dedicated username and...
Astra Linux – Vulnerability in Lynx
Lynx versions up to 2.8.9 mishandled the userinfo subcomponent of a URI, allowing remote attackers to discover cleartext credentials, as these credentials might appear in SNI data...
CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)
The ckangetmqaquality and ckangetmqaqualitydetails tools restrict their serverurl argument to dati.gov.it via a regular expression. The regex is anchored only at the start and places no boundary after the host, so any URL whose host merely begins with dati.gov.it — or that uses dati.gov.it as URL...
CVE-2026-73845
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckangetmqaquality and ckangetmqaqualitydetails tools in src/tools/quality.ts use isValidMqaServer to validate the serverurl parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host an...
CVE-2026-73845
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckangetmqaquality and ckangetmqaqualitydetails tools in src/tools/quality.ts use isValidMqaServer to validate the serverurl parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host an...
CVE-2026-55982
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes...
EUVD-2026-58138
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes...
CVE-2026-55982 OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes...
CVE-2026-55982
The Gitea application is vulnerable to an issue where the OIDC userinfo Endpoint returns identity claims without enforcing API token scopes . This vulnerability allows for the exposure of sensitive information to unauthorized actors. Remediation is available in Gitea v1.27.0 , which includes fixe...
