Keycloak-12.0.1-CVE-2020-10770

Keycloak-12.0.1-CVE-2020-10770 Keycloak 12.0.1 - Слепая подделка серверных запросов SSRF без аутентификации 'requesturi' Exploit-DB-50405 Ожидаемый результат: сканирование портов localhost или внутренних хостов. Предназначено только для образовательных целей и тестирования в корпоративных средах...

CVE-2024-22120-RCE-with-gopher

Использование python exploit.py --ip --sid --hostid --phpsessid --falsetime --truetime Краткое описание Этот эксплоит был создан для использования уязвимости XXE внешняя XML-сущность. С его помощью я прочитал серверный код веб-сервиса и нашёл конечную точку, где можно использовать gopher для...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.41 security and extras update

Red Hat OpenShift Container Platform release 4.20.41 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a security impact of...

CVE-2022-31188

CVE-2022-31188 CVE-2022-31188 - OpenCV CVAT Computer Vision Annotation Tool SSRF CVAT — это инструмент аннотации изображений с открытым исходным кодом, разработанный Intel. Любой пользователь с правами «Создание задачи» может вызвать уязвимость SSRF, отправив вредоносный HTTP-запрос, и получить...

Internal-Monologue

Attaque Monologue Interne : Récupération des hachages NTLM sans toucher à LSASS Introduction Mimikatz, développé par Benjamin Delpy @gentilkiwi, est un outil de post-exploitation bien connu qui permet aux attaquants d'extraire les mots de passe en texte clair, les hachages NTLM et les tickets...

CVE-2026-106501 Backstage: Sensitive information exposure in Scaffolder

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may...

CVE-2026-106501 Backstage: Sensitive information exposure in Scaffolder

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may...

CVE-2026-106501

The Backstage open framework for developer portals is vulnerable to sensitive information exposure in the @backstage/plugin-scaffolder-backend package. Prior to versions 3.3.1, 3.4.1, 4.0.3, and 4.1.0 , an authenticated user capable of reading another user's Scaffolder task can access internal ex...

CVE-2021-26855

CVE-2021-26855 CVE-2021-26855 SSRF Простое использование Практика Golang Затронутые версии Exchange Server 2013 ниже CU23 Exchange Server 2016 ниже CU18 Exchange Server 2019 ниже CU7 Условия эксплуатации Эта уязвимость отличается от предыдущих уязвимостей Exchange. Для её использования не требует...

CVE-2026-89430

Gitea validated a push mirror's remote address against the migrations allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to git push, so a name that later resolved to a blocked or internal address was still reached. A user with...

CVE-2026-101027

When migrations ALLOWEDDOMAINS was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restrictions. A user who can start repository migrations and control the DNS of an allowed hostname could make it resolve to loopback or...

CVE-2026-101029

Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to. A low-privileged user who can create migrations or mirrors could direct th...

slipstream

NAT Slipstreaming NAT Slipstreaming permet à un attaquant d’accéder à distance à tout service TCP/UDP lié à n’importe quel système derrière le NAT d’une victime, en contournant le NAT/pare‑feu de la victime contrôle à distance arbitraire des ouvertures de pare‑feu, simplement en visitant un site...

CVE-2026-89430 Gitea push mirror SSRF and forced writes to internal Git hosts

Gitea validated a push mirror's remote address against the migrations allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to git push, so a name that later resolved to a blocked or internal address was still reached. A user with...

CVE-2026-89430 Gitea push mirror SSRF and forced writes to internal Git hosts

Gitea validated a push mirror's remote address against the migrations allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to git push, so a name that later resolved to a blocked or internal address was still reached. A user with...

CVE-2026-101029 Gitea migration and pull mirror SSRF through multi-answer DNS

Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to. A low-privileged user who can create migrations or mirrors could direct th...

CVE-2026-101029 Gitea migration and pull mirror SSRF through multi-answer DNS

Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to. A low-privileged user who can create migrations or mirrors could direct th...

EUVD-2026-93908

When migrations ALLOWEDDOMAINS was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restrictions. A user who can start repository migrations and control the DNS of an allowed hostname could make it resolve to loopback or...

CVE-2022-41401

OpenRefine = v3.5.2 SSRF OpenRefine v=3.5.2 содержит уязвимость подделки запросов на стороне сервера SSRF, которая позволяет неавторизованным пользователям эксплуатировать систему, что потенциально может привести к несанкционированному доступу к внутренним ресурсам и раскрытию конфиденциальных...