CVE-2026-3854-PoC

CVE-2026-3854 PoC — X-Stat Push Option Injection による GitHub RCE 教育目的および許可を得たセキュリティ研究目的のみに使用してください。 明示的な書面による許可なしに、いかなるシステムに対しても使用しないでください。 概要 CVE-2026-3854 は、GitHub Enterprise Server（および GitHub.com）の git push パイプラインにおけるリモートコード実行（RCE）の脆弱性です。 クライアントが push オプション（git push -o）を指定すると、GitHub の内部 Ruby...

Scoold < 1.64.0 - Authentication Bypass

Scoold is a Q&A and a knowledge sharing platform for teams. A semicolon path injection vulnerability was found on the /api;/config endpoint. By appending a semicolon in the URL, attackers can bypass authentication and gain unauthorised access to sensitive configuration data. Furthermore, PUT...

CVE-2020-13933

CVE-2020-13933 ラボ shiro 1.6.0 認証バイパス脆弱性 PoC http://127.0.0.1:8080/res/%3bpoc ラボ環境 コード説明 ShiroConfig.java： 権限設定。/res/ リソースへのリクエスト時に、302でログインページにリダイレクトし認証を行う。 NameController.java： ・ /res/name： name という名前のリソースをリクエスト（認証をトリガー） ・ /res/： リソースをリクエストしない（認証をトリガーしない） ラボ検証...

CVE-2023-36143

CVE-2023-36143 CVE-2023-36143のPoC - Maxprint Maxlink 1200G v3.4.11E コマンドインジェクション 再現手順: 1. Webブラウザで機器にログインします。 2. 診断ツールに移動します。 3. 任意のIP（例：127.0.0.1）、セミコロン、コマンドを入力します。 4. 例: 127.0.0.1;cat /etc/passwd...

CVE-2021-26085

CVE-2021-26085 Atlassian Confluence Server 7.5.1 事前認証任意ファイル読み取り脆弱性のPOC 脆弱なエンドポイント： WEB-INF/web.xml WEB-INF/decorators.xml WEB-INF/classes/seraph-config.xml META-INF/maven/com.atlassian.confluence/confluence-webapp/pom.properties META-INF/maven/com.atlassian.confluence/confluence-webapp/pom.xml PO...

PSTrojanFile

PSTrojanFile Windows PowerShell Nombre de Archivo y API Anti-Malware de Defender - POC de Ejecución de Código Descubrimiento: John Page alias hyp3rlinx 2019 y revisado 2023 Actualizado 24 de diciembre de 2023 Evadiendo el obstáculo de las comillas simples en PowerShell para ejecución de código y,...

CVE-2021-26086

CVE-2021-26086 Atlassian Jira Server/Data Center 8.4.0 - 限定されたリモートファイル読み取り/インクルード 脆弱性のあるエンドポイント: WEB-INF/web.xml WEB-INF/decorators.xml WEB-INF/classes/seraph-config.xml META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.xml...

CVE-2023-41080

脆弱: http://localhost:8081//secret.html;@example.com 任意のWebサイトにリダイレクトされます（この場合は、https://example.com）。 修正済み: http://localhost:8082//secret.html;@example.com 参照: https://github.com/advisories/GHSA-q3mw-pvr8-9ggc...

SUSE CVE-2026-73511

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving...

SUSE CVE-2026-73551

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefor...

CVE-2026-73511 Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving...

EUVD-2026-84121

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving...

EUVD-2026-84119

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefor...

CVE-2026-73551 Envoy: Path normalization does not handle dot and dotdot segments with parameters

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefor...

CVE-2026-73551

Envoy is an open-source edge and service proxy for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 , its URL normalization does not recognize dot and dotdot path segments carrying semicolon parameters . A request such as /user/..;foo=bar/admin is not canonicalized to /admi...

CVE-2026-73551: Use of Non-Canonical URL Paths for Authorization Decisions

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefor...

CVE-2026-73511: Authentication Bypass by Alternate Name

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving...

CVE-2026-69211

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated...

EUVD-2026-79175

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated...

CVE-2026-69211

Http4s is a Scala library for HTTP services. Prior to 0.23.35 and 1.0.0-M47 , the ResponseCookie.render method writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from u...