655 matches found
CVE-2024-25175
CVE-2024-25175 HTTPレスポンススプリッティングによる反射型XSS 説明 : この脆弱性を悪用すると、特別に細工されたリンクをクリックした際に、被害者のブラウザでJavaScriptコードが実行される（クロスサイトスクリプティング）可能性があります。この脆弱性は、Webサーバーが改行（\r\n または CR\LF、urlencodeでは %0d%0a）を正しく処理しないために発生します。 影響 : 反射型XSS CVSSv3.1ベクター : AV:N/AC:L/PR:N/UI:R/S:C:C/L:I/L:A:N 6.1 CWE : CWE-20: 不適切な入力検証...
Astra Linux – Vulnerability in Firefox
The “Copy Image Link” context menu action would copy the final image URL after redirects. By embedding an image that triggered authentication flows—in conjunction with a Content Security Policy that stopped a redirection chain in the middle—the final image URL could contain an authentication toke...
openclaw-hardening-check
このスクリプトは読み取りのみを行います。何も修正せず、安全であることを保証するものではありません。緑色の出力は、以下にリストされたチェックが合格したことのみを意味します。それ以上の意味はありません。 OpenClaw ハードニングチェック openclaw-hardening-check.mjs は、依存関係のない小さなオフラインスクリプトで、OpenClaw インストールのレビューを行います。ローカル設定、パッケージメタデータ、プラグインとスキルのマニフェスト、ファイルモード、そしてLinuxでは実行中のGatewayの /proc...
CVE-2026-82255
gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective U...
EUVD-2026-67581
gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective U...
EUVD-2026-67283
An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session informati...
CVE-2026-76179
An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session informati...
CVE-2026-79782
rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS session tokens sent in request headers...
CVE-2026-76389
In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, a user that holds a role with the gettalosenrichment capability could send a crafted request to the Talos intelligence enrichment Representational State Transfer REST API endpoint and cause the instance to make an...
CVE-2026-75915
CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the jsexecution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API key...
CVE-2026-75915 CodeWhale before 0.8.64 Environment Variable Leak via js_execution
CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the jsexecution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API key...
CVE-2026-75010
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver...
CVE-2026-75010
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver...
CVE-2026-75010
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver...
CVE-2026-75010
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver...
CVE-2026-75010
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the password plugin's modoboa driver can leak a Modoboa API authentication token to a user-controlled host via crafted session data, affecting only instances using that driver. CVSS 3.1 score is 6.4 (Medium). Patches are available in 1.6....
CVE-2026-75010
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver...
CVE-2026-46405
A flaw was found in OpenBao, an identity-based secrets management system. When the Kerberos authentication method processes a GET request or an Authorization: Negotiate header, it inadvertently creates authentication tokens that are not accessible to the caller and are hidden by an error message...