puma_header_normalization-CVE-2024-45614

Puma Header normalization CVE-2024-45614 確認 advisory: https://github.com/puma/puma/security/advisories/GHSA-9hf4-67fc-4vf4 修正コミット: https://github.com/puma/puma/commit/cac3fd18cf29ed43719ff5d52d9cfec215f0a043 結果 request.rbの実行結果 duplicate 対象| 結果 ---|--- pumabeforefixrack2| XFORWARDEDFOR: 2.2.2.2...

CVE-2025-25257

Fortinet FortiWeb CVE-2025-25257 脆弱性テスター 説明 このPowerShellスクリプトは、認可されたペネトレーションテスト 専用に設計されています。Fortinet FortiWebアプライアンスの/api/fabric/device/statusエンドポイントにおける未認証SQLインジェクション脆弱性CVE-2025-25257をテストします。 このスクリプトは以下のことを行います： テスト環境向けにTLS証明書エラーを無視します。 単一ターゲット（IP/DNS、オプションでポート指定）またはファイルからのターゲットリストを受け付けます。...

CVE-2026-88899

CVE-2026-88899 - Knowns 0.30.0 未認証ヘッダーインジェクションによりAIエージェントがホストファイルシステムへ無制限にアクセス可能 概要 Knownsの組み込みOpenCode...

CVE-2025-61882-CVE-2025-61884

CVE-2025-61882 & CVE-2025-61884 編集: Oracle は新しい脆弱性 CVE-2025-61884 を開示しました。この脆弱性の検出スクリプトは、このリポジトリまたは元の場所https://gist.github.com/rxerium/6c70bc6b72fc0d1365c85937d35d9550 にあります。 以下は Oracle のセキュリティアドバイザリ からの引用です： このセキュリティ・アラートは、Oracle E-Business Suite の脆弱性 CVE-2025-61882...

react-cve-2025-55182-lab

セットアップ: git clone https://github.com/alexandre-briongos-wavestone/react-cve-2025-55182-lab cd react-cve-2025-55182-lab sudo docker build -t react-rsc-lab . sudo docker run -p 3000:3000 react-rsc-lab エクスプロイト: curl --path-as-is -i -s -k -X $'POST' \ -H $'Host: localhost:3000' -H $'User-Agent:...

netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.19 Update

An update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability scoring System CVSS base score, which gives a detailed severity rating, ...

AlmaLinux 9.2 [TuxCare] Security Update: haproxy Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1736503350)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1736503350 advisory. - HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x befor...

PT-2026-103310

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible...

Rocky Linux 9.6 [TuxCare] Security Update: osbuild-composer / osbuild-composer-core / osbuild-composer-tests / etc (ALMALINUX9.6:CLSA-2026:1790156031)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790156031 advisory. - Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. CVE-2026-42504 Note that Ness...

AlmaLinux 9.2 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal (ALMALINUX9.2:CLSA-2026:1783705168)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783705168 advisory. - Successfully using libcurl to do a transfer to a specific HTTP origin hostA with Digest authentication and then changing the origin to a...

AlmaLinux 9.2 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc (ALMALINUX9.2:CLSA-2025:1753987188)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1753987188 advisory. - Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the...

CentOS Linux 7 [TuxCare] Security Update: libsoup / libsoup-devel (CENTOS7:CLSA-2025:1744892440)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1744892440 advisory. - GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored,...

Rocky Linux 9.6 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1774022191)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1774022191 advisory. - The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation...

CentOS Linux 8.5 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1771499011)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1771499011 advisory. - The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation reject...

CentOS Linux 8.4 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1782159334)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1782159334 advisory. - When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch...

AlmaLinux 9.2 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778129970)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778129970 advisory. - During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the...

CVE-2026-100263: Improper Neutralization of Input During Web Page Generation

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible...

AlmaLinux 9.2 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1776763201)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1776763201 advisory. - A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF Carriage Return Line Feed Injection, occurs...

TencentOS Server 4: libevent (TSSA-2026:1051)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1051 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...