CVE-2021-21349

CVE-2021-21349 XStream SSRF XStream 공식 발표 CVE-2021-21349 취약점 CVE-2021-21349: XStream으로 언마샬링하면 서버 측 위조 요청Server-Side Forgery Request이 활성화되어 인트라넷 또는 로컬 호스트의 리소스를 참조하는 임의의 URL의 데이터 스트림에 접근할 수 있습니다. 영향을 받는 버전 기본 제공 버전을 사용하는 경우 1.4.15를 포함한 모든 버전이 영향을 받습니다. 최소 필수 유형으로 제한된 화이트리스트로 XStream의 보안 프레임워크를 설정하...

xiaomi-cve-2024-45352

xiaomi-cve-2024-45352 Xiaomi의 심각한 취약점에 대한 기술 보고서 취약점 요약 다양한 MIUI 기기의 Xiaomi 기본 브라우저com.android.browser에서 취약점이 발견되었습니다. 이 앱은 startActivity를 통해 전달된 인텐트를 제대로 검증하지 못하여, 악성 앱이 임의의 URL을 열거나 의도하지 않은 작업을 수행할 수 있습니다. CVE ID : CVE-2024-45352 구성 요소 :com.android.browser 심각도 : Medium 상태 : Xiaomi에 보고됨 확인 대기 중 ...

CVE-2019-11708

CVE-2019-11708 및 CVE-2019-9810을 위한 전체 체인 익스플로잇 이것은 Windows 64비트에서 Firefox를 대상으로 하는 전체 브라우저 손상 익스플로잇 체인CVE-2019-11708 및 CVE-2019-9810입니다. CVE-2019-9810을 사용하여 콘텐츠 프로세스와 부모 프로세스 모두에서 코드 실행을 얻고, CVE-2019-11708을 사용하여 부모 프로세스를 속여 임의의 URL로 이동하게 합니다. 저는 과거에 A journey into IonMonkey: root-causing...

PT-2026-88959

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...

Malicious code in data-value (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa1f0fee2d6635331e603f520ba2954b11ac9e85bbd5b66f27c18be5940c3041 package.json declares the package's own name 'data-value' as a dependency whose source is an arbitrary HTTPS URL...

MAL-2026-15518 Malicious code in payments-ui-services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4b49e2f4d16837b49ca7d82e2c5a46c2a861c3f2c3d63596c730749dfec0337 package.json line 11 declares a dependency whose source is the arbitrary HTTPS URL https://repo.securityctrl.com/payments-ui-services instead of a...

Malicious code in payments-ui-services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4b49e2f4d16837b49ca7d82e2c5a46c2a861c3f2c3d63596c730749dfec0337 package.json line 11 declares a dependency whose source is the arbitrary HTTPS URL https://repo.securityctrl.com/payments-ui-services instead of a...

CVE-2026-19801 BetterLinks <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation via create_fbs_link AJAX Action

The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

Open Redirect

Overview org.springframework:spring-webmvc is a package that provides Model-View-Controller MVC architecture and ready components that can be used to develop flexible and loosely coupled web applications. Affected versions of this package are vulnerable to Open Redirect in the...

ANT-2026-6YNNSAA0 · supabase/supabase · other

other low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-6YNNSAA0: Image-generation function fetches arbitrary caller URL with service-role in scope The...

CVE-2026-16049

Mattermost Plugins versions =11.8 10.20.11 11.5.7.0 The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied postid, and fails to validate the weburl parameter against the configured GitLab instance, which allows an authenticated attacke...

CVE-2026-16049

Mattermost Plugins versions =11.8 10.20.11 11.5.7.0 The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied postid, and fails to validate the weburl parameter against the configured GitLab instance, which allows an authenticated attacke...

CVE-2026-22072

Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens...

CVE-2026-22072

CVE-2026-22072 involves arbitrary URL loading in WebView, where loading external URLs can permit malicious JavaScript to steal user tokens. The connected document confirms the issue arises from WebView behavior, enabling token leakage with a CVSS v4.0 base score of 8.3 (HIGH), attack vector Netwo...

CVE-2026-22072

Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens...

EUVD-2026-60058

Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens...

CVE-2026-22072 Arbitrary URL Loading in WebView Leading to Token Leakage Risk

Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens...

CVE-2026-22072 Arbitrary URL Loading in WebView Leading to Token Leakage Risk

Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens...

PT-2026-73214

Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens...

PT-2026-76671

Mattermost Plugins versions =11.8 10.20.11 11.5.7.0 The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied post id , and fails to validate the web url parameter against the configured GitLab instance, which allows an authenticated...