338 matches found
certbot
.. This file contains a series of comments that are used to include sections of this README in other files. Do not modify these comments unless you know what you are doing. tag:intro-begin |build-status| .. |build-status| image::...
MLflow Job API - Authentication Bypass
MLflow latest version contains an authentication bypass caused by unprotected FastAPI job endpoints under /ajax-api/3.0/jobs/ when basic-auth is enabled, letting unauthenticated network clients submit and manage jobs, exploit requires job execution enabled and allowlisted job functions. id:...
CVE-2026-41940_exploit
CVE-2026-41940 - Exploit de Omisión de Autenticación en cPanel & WHM Vulnerabilidad: Manipulación de archivos de sesión mediante inyección CRLF en el manejador de autenticación HTTP Basic de cpsrvd CVE: CVE-2026-41940 CVSS: 9.8 Crítico CWE: CWE-93 Inyección CRLF / CWE-306 Autenticación Ausente...
gitea-CVE-2026-28699
CVE-2026-28699: Omisión de alcance OAuth2 de Gitea a través de autenticación básica HTTP Un token de acceso OAuth2 de Gitea con alcance solo read:user puede realizar acciones de escritura completas cuando se envía como Authorization: Basic base64:x-oauth-basic en lugar de como un token Bearer. La...
phpBB-CVE-2026-48611
USE AT YOUR OWN RISK. This tool is provided strictly for authorized security research, penetration testing, and educational purposes. Only run it against systems you own or have explicit, written permission to test. The author is not responsible or liable for any illegal or unethical use of this...
CVE-2025-1739
CVE-2025-1738 & CVE-2025-1739 — PoC de la Cámara Trivision NC227WF 📋 Resumen CVE| CVSS v3.1| Puntuación| CWE| Tipo ---|---|---|---|--- CVE-2025-1739| AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N| 7.1| CWE-288| Omisión de autenticación mediante fuga de autenticación básica 🔓 CVE-2025-1739 — Exposición de...
vicidial-cve-2024-8503-blind-sqli-poc
vicidial-cve-2024-8503-blind-sqli-poc Prueba de concepto PoC de inyección SQL ciega basada en tiempo no autenticada para el endpoint VERMAJAXfunctions.php de VICIdial CVE-2024-8503. El proyecto está destinado únicamente a pruebas de seguridad autorizadas, validación y educación. Resumen...
CVE-2025-4476-Exploit
Exploit CVE-2025-4476 Un pequeño cliente de prueba en Python para enviar solicitudes HTTP GET con una cabecera Authorization: Basic de tamaño excesivo. Esta herramienta está destinada a pruebas de laboratorio e investigación sobre problemas de análisis de cabeceras por ejemplo, errores de...
CVE-2026-66070
RabbitMQ is a messaging and streaming broker containing a vulnerability in the rabbit_mgmt_cors.erl component. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6 , the match_origin/1 function incorrectly reflected the request Origin while allowing credentials when a wildcard (*) was configured....
CVE-2026-66070 RabbitMQ: CORS * reflects Origin with Allow-Credentials
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...
MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches
Summary makessrfsafehook blocks HTTP redirects to private/internal IPs by validating the Location header before the client follows a 3xx response. The problem is that this hook is only attached in one of three authentication branches — the header-PAT path. Basic auth and OAuth branches skip it...
GHSA-6529-C226-H328 MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches
Summary makessrfsafehook blocks HTTP redirects to private/internal IPs by validating the Location header before the client follows a 3xx response. The problem is that this hook is only attached in one of three authentication branches — the header-PAT path. Basic auth and OAuth branches skip it...
CVE-2026-77261
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, makessrfsafehook is omitted from JiraFetcher and ConfluenceFetcher sessions created through the basic-auth and oauthpat branches. If an attacker-controlled or compromised configured...
EUVD-2026-84631
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, makessrfsafehook is omitted from JiraFetcher and ConfluenceFetcher sessions created through the basic-auth and oauthpat branches. If an attacker-controlled or compromised configured...
CVE-2026-77261 MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, makessrfsafehook is omitted from JiraFetcher and ConfluenceFetcher sessions created through the basic-auth and oauthpat branches. If an attacker-controlled or compromised configured...
CVE-2026-77261 MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, makessrfsafehook is omitted from JiraFetcher and ConfluenceFetcher sessions created through the basic-auth and oauthpat branches. If an attacker-controlled or compromised configured...
CVE-2026-77261
The MCP Atlassian Model Context Protocol server (versions prior to 0.22.0 ) is vulnerable to Server-Side Request Forgery (SSRF) due to a missing _make_ssrf_safe_hook in the JiraFetcher and ConfluenceFetcher sessions. Specifically, sessions created via the basic-auth and oauth_pat branches can be ...
CVE-2026-77261 MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, makessrfsafehook is omitted from JiraFetcher and ConfluenceFetcher sessions created through the basic-auth and oauthpat branches. If an attacker-controlled or compromised configured...
CVE-2026-77261: Server-Side Request Forgery (SSRF)
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, makessrfsafehook is omitted from JiraFetcher and ConfluenceFetcher sessions created through the basic-auth and oauthpat branches. If an attacker-controlled or compromised configured...