176362 matches found
CVE-2021-40346
CVE-2021-40346 — HAProxy Integer Overflow leading to HTTP Request Smuggling 취약점 요약 HAProxy는 오픈소스 기반 리버스 프록시 겸 로드 밸런서로, 부하 분산 및 ACL접근 제어 규칙 처리 등을 담당하는 소프트웨어임 CVE-2021-40346은 HAProxy가 HTTP 헤더를 내부 HTX 포맷으로 저장하는 htxaddheader 함수에서 헤더 이름Header Name의 길이를 검증하지 않는 과정에서 발생하는 접근 제어 우회ACL Bypass 취약점 이 취약점은...
CVE-2026-79686
Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to bypass access restrictions and gain escalated privileges...
CVE-2026-79686
Dell PowerStore contains a Protection Mechanism Failure vulnerability that allows an authenticated user with limited privileges to bypass access restrictions and gain escalated privileges. The Dell-assigned CVSS 3.1 score is 8.8 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicat...
EUVD-2026-69213
Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to bypass access restrictions and gain escalated privileges...
CVE-2026-80047
Hugging Face Transformers (versions 4.49.0 through 5.8.1) contains a consent-bypass flaw in GenerativePreTrainedModel.load_custom_generate() . The function fetches and writes a remote Python module to ~/.cache/huggingface/modules via an unconditional file copy in dynamic_module_utils.py before ev...
EUVD-2026-69144
A vulnerability in Hugging Face Transformers versions = 4.49.0 and = 5.8.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...
CVE-2026-79684
Dell PowerStore contains a Protection Mechanism Failure vulnerability (CVE-2026-79684, CVSS 3.1 score 8.8 HIGH ). An authenticated user with limited privileges could bypass access restrictions to gain escalated privileges , with high impact on confidentiality, integrity, and availability over the...
cve-2026-21509-office_security_bypass_reproduction
CVE-2026-21509 — Microsoft Office セキュリティ機能バイパス CVE-2026-21509 は、Microsoft Office のセキュリティ機能バイパスの脆弱性です CVSS 7.8 、APT28（ロシアのハッカー） によってウクライナに対して積極的に悪用されています セキュリティ上の判断における信頼できない入力への依存（CWE-807 ）— 「kill bit の無効化」 悪意のあるドキュメントを介した Protected View および OLE 緩和策 のバイパスを許可します Office 2016、2019、2021、2024、Microsof...
cve-2025-24472-fortinet_authbypass_reproduction
CVE-2025-24472 — Fortinet FortiOS / FortiProxy 認証バイパス 概要 CVE-2025-24472 は、Fortinet FortiOS および FortiProxy における認証バイパスの脆弱性です。認証されていない攻撃者は、特別に細工された CSF Central Security Fabric プロキシリクエストを作成し、影響を受けるデバイス上でスーパー管理者権限を取得できます。この欠陥の CVSS スコアは 8.1 で、SuperBlack Mora001 を含むランサムウェアグループによって活発に悪用されていることが知られています。...
cve-2024-0012_9474-panos_authbypass_reproduction
CVE-2024-0012 / CVE-2024-9474 — PAN-OS 認証バイパス → 権限昇格チェーン CVE| 説明| CVSS ---|---|--- CVE-2024-0012| PAN-OS 管理インターフェイスの認証バイパス| 9.3 CVE-2024-9474| PAN-OS の権限昇格| 6.9 連鎖させると、これらの脆弱性により、PAN-OS 管理 Web インターフェイス上で認証なしのリモートコード実行 が可能になります。 いずれもゼロデイとして実際に悪用 されており、Operation Lunar Peek として追跡されています。この調査は当初...
CVE-2026-43700
CVE-2026-43700 WebKit WebGPU importExternalTexture 교차 출처 정보 유출. Safari 빨강/초록/파랑/흰색 수정 버전 = 26.5.2: PATCHED importExternalTexture blocked: SecurityError 원리 GPUDevice.importExternalTexturesource: HTMLVideoElement는 동영상을 GPU가 샘플링할 수 있는 GPUExternalTexture로 가져옵니다. 수정 전에는 동영상에 대해 교차 출처 확인을 하지 않았으며, 교차...
CVE-2026-54761-poc
CVE-2026-54761: Traefik Kubernetes Gateway crossProviderNamespaces Bypass PoC English version 개요 이 저장소는 Traefik의 Kubernetes Gateway provider에 존재하는 고심각도 취약점 CVE-2026-54761 을 로컬 환경에서 재현하기 위한 Proof of Concept PoC입니다. 이 취약점은 crossProviderNamespaces의 허용 목록에 영향을 미칩니다. 여러 가중치가 있는 백엔드 참조를 선언하는 HTTPRoute...
cve-2024-1708-connectwise_rce_reproduction
CVE-2024-1708 / CVE-2024-1709 — ConnectWise ScreenConnect 認証バイパスおよびリモートコード実行 CVSS スコア: 8.4 CVE-2024-1708 – 10.0 CVE-2024-1709 CWE: CWE-22（パストラバーサル）、CWE-288（代替パスを使用した認証バイパス） 影響を受けるソフトウェア: ConnectWise ScreenConnect（旧 ScreenConnect）≤ 23.9.7 発見・報告: 2024年2月 実環境での悪用: LockBit、Black Basta、Bl00dy...
CVE-2026-84218 Org.jolokia/jolokia-core: incomplete jndi denylist in jolokia jsr-160 proxy (bypass of cve-2018-1000130 fix)
A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a target.url value from a Jolokia POST request and passes it to JMXServiceURL an...
EUVD-2026-69129
A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a target.url value from a Jolokia POST request and passes it to JMXServiceURL an...
CVE-2026-84218 Org.jolokia/jolokia-core: incomplete jndi denylist in jolokia jsr-160 proxy (bypass of cve-2018-1000130 fix)
A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a target.url value from a Jolokia POST request and passes it to JMXServiceURL an...
CVE-2026-84218
CVE-2026-84218 affects Jolokia (org.jolokia/jolokia-core), a JMX-over-HTTP bridge. The flaw is in the JSR-160 proxy functionality, where the JNDI denylist introduced to mitigate CVE-2018-1000130 is incomplete. The denylist only rejects URLs matching service:jmx:rmi:///jndi/ldap:.*, but attacker-c...
CVE-2026-84218
A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a target.url value from a Jolokia POST request and passes it to JMXServiceURL an...
CVE-2026-84147
This vulnerability exists in the ERP system due to improper authentication controls and inadequate file type validation at the API endpoint. An unauthenticated remote attacker could exploit this vulnerability by uploading arbitrary files to a web accessible directory on the targeted system...