GHSA-WVM9-9G5J-623F Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization

Summary There is a high-severity request-smuggling vulnerability in Traefik's handling of the HTTP/1.1 Upgrade mechanism. Since Traefik moved to unencrypted HTTP/2 with prior knowledge Go 1.24, a client-initiated Upgrade: h2c request header and its connection-specific HTTP2-Settings header were...

GHSA-W4V4-9RW7-5326 Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization

Summary There is a high-severity request-smuggling vulnerability in Traefik's handling of the HTTP/1.1 Upgrade mechanism. Since Traefik moved to unencrypted HTTP/2 with prior knowledge Go 1.24, a client-initiated Upgrade: h2c request header and its connection-specific HTTP2-Settings header were...

GHSA-V67P-PHPQ-FC8X Traefik entrypoint header-name sanitization bypassed via request trailers

Summary Traefik's entrypoint defenses against spoofed trusted header names — aliasHeadersStrategy / underscoreHeadersStrategy in delete or reject mode, and the default forwardedHeaders stripping of client-supplied X-Forwarded- — scan req.Header only and never req.Trailer. An unauthenticated clien...

Traefik entrypoint header-name sanitization bypassed via request trailers

Summary Traefik's entrypoint defenses against spoofed trusted header names — aliasHeadersStrategy / underscoreHeadersStrategy in delete or reject mode, and the default forwardedHeaders stripping of client-supplied X-Forwarded- — scan req.Header only and never req.Trailer. An unauthenticated clien...

GHSA-F52W-8J3H-J724 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

Summary Traefik accepts an HTTP/1.x request whose request-target is in rootless / opaque form for example GET http:http://internal-vhost/admin HTTP/1.1. Go parses this into URL.Opaque with an empty URL.Path, so Traefik evaluates all routing, path-sanitization, middleware and access-log decisions...

Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

Summary Traefik accepts an HTTP/1.x request whose request-target is in rootless / opaque form for example GET http:http://internal-vhost/admin HTTP/1.1. Go parses this into URL.Opaque with an empty URL.Path, so Traefik evaluates all routing, path-sanitization, middleware and access-log decisions...

cve-2025-31651

CVE-2025-36701 — Apache Tomcat - リライトルールバイパス 発見者: gregk4sec https://github.com/gregk4sec/cve 発見日: 2025-02-28 影響を受けるベンダー: Apache 影響を受ける製品: Tomcat 9.0.x / 10.1.x / 11.0.x 深刻度: Critical / High CWE: CWE-116 ステータス: 審査中 / 修正済み / 公開 ✅ / 非公開 概要...

PIL-RCE-Ghostscript-CVE-2018-16509

通过 Ghostscript CVE-2018-16509 实现 Python PIL/Pillow 远程 Shell 命令执行 灵感来源于 https://github.com/ysrc/PIL-RCE-By-GhostButt（PIL/Pillow RCE via CVE-2017-8291）。这个 Docker 环境使用的是较新版本的 Ghostscript v9.23 和较新的漏洞利用 CVE-2018-16509。 Ghostscript 是一套基于 Adobe Systems PostScript 和 Portable Document Format PDF...

CVE-2019-17240_Bludit-BF-Bypass

CVE-2019-17240 Exploit/PoC - Bludit 暴力破解缓解绕过 针对 CVE-2019-17240（又名 Bludit = 3.9.2 暴力破解缓解绕过）的漏洞利用代码 漏洞利用链接: ExploitDB-48942 PacketStorm 预期结果：发现登录凭据，绕过运行 Bludit =3.9.2 的主机上的暴力破解机制。 仅用于企业环境中的教育和测试。 此漏洞利用已在 Python 3.8.6 上测试。 用法 root@kitploit: cfx: /bludit → ./exploit.py -h usage: exploit.py -h -l URL ...

bypass-403

Bypass-403 403バイパス用に自分用に作成したシンプルなスクリプト 以下のスナップショットに示すように、さまざまな条件でのレスポンスを比較するためにも使用できます 使い方 ./bypass-403.sh https://example.com admin ./bypass-403.sh website-here path-here 機能 curlを使用して403の既知のバイパス24個を利用 インストール git clone https://github.com/iamj0ker/bypass-403 cd bypass-403 chmod +x bypass-403.sh su...

CVE-2025-4517-Python-tarfile-filter-data-Bypass-PoC

CVE-2025-4517 — Python tarfile filter="data" 绕过（PoC） Python tarfile 模块中的路径遍历漏洞，影响 3.8.0 至 3.13.1 版本。filter="data" 沙箱旨在防止不安全的解压操作，但可通过构造超过 PATHMAX（4096 字节）的路径来绕过，导致 os.path.realpath 静默停止解析符号链接。安全检查看到的是一个看似安全的路径，而内核解析的是真实路径，从而允许在解压目录之外写入文件。此 PoC 利用该绕过方式将 SSH 公钥写入 /root/.ssh/authorizedkeys。 工作原理 1...

rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

Summary rclone serve s3's handler chain, when --auth-proxy is configured, is outermost first: authPairMiddleware - proxyAuthMiddleware - gofakes3's own SigV4-verifying handler. authPairMiddleware parses the accessKeyID straight out of the incoming request's own Authorization header entirely...

GHSA-XWWR-4H3P-R22C rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

Summary rclone serve s3's handler chain, when --auth-proxy is configured, is outermost first: authPairMiddleware - proxyAuthMiddleware - gofakes3's own SigV4-verifying handler. authPairMiddleware parses the accessKeyID straight out of the incoming request's own Authorization header entirely...

BadParcel

BadParcel 关于此漏洞类的深入分析，请参见 Bundle Fengshui。 此仓库包含 CVE-2023-20963 的 PoC，该漏洞是 Android WorkSource 的 parcel/unparcel 逻辑中的不匹配问题。 该漏洞已在 2023 年 3 月的 Android 安全公告中修复。该利用应适用于运行 AOSP 版本 11、12、12L、13，且安全补丁级别在 2023 年 3 月之前的设备。 利用 CVE-2023-20963 PoC 绕过屏幕锁...

GHSA-P569-5GJG-9CMJ rclone: RC per-server auth-proxy bypass

Summary serve/start accepts protocol options in a per-server proxyOpt object. The FTP and S3 RC adapters parse that object and pass it to their server constructors, but the constructors decide whether proxy authentication is enabled by checking the process-global proxy.Opt.AuthProxy instead of th...

rclone: RC per-server auth-proxy bypass

Summary serve/start accepts protocol options in a per-server proxyOpt object. The FTP and S3 RC adapters parse that object and pass it to their server constructors, but the constructors decide whether proxy authentication is enabled by checking the process-global proxy.Opt.AuthProxy instead of th...

CVE-2022-46169

Cacti remoteagent.php 远程命令执行漏洞 CVE-2022-46169 漏洞描述 Cacti是一个服务器监控与管理平台。在其1.2.17-1.2.22版本中存在一处命令注入漏洞，攻击者可以通过X-Forwarded-For请求头绕过服务端校验并在其中执行任意命令。 漏洞影响 Cacti 1.2.17-1.2.22 网络测绘 app="Cacti-监控系统" 漏洞复现...

CVE-2024-55591-POC

ScaryByte R&D PoC for CVE-2024-55591 CVE-2024-55591の認証バイパス脆弱性を発見・悪用するための、包括的なオールインワン PythonベースのProof of Conceptスクリプト。このスクリプトは以下の機能を備えています： 1. 不足している依存関係を自動インストール 2. Nmapを使用した対象ホストのオープンポートスキャン （オプション） 3. 対象サービスがFortinetデバイスであり、脆弱性が存在するか確認する事前チェック 4. WebSocketインターフェースを悪用 してTelnetライクなCLIセッションを乗っ取り 5...

opgp-service-cve-2019-9153

CVE-2019-9153 漏洞 基于 BSI 的设置复现 PoC 调查 opgp-service API 对此类攻击的脆弱性 使用以下命令运行测试： root@kitploit: npm test 结论： opgp-service 默认配置了 AEADprotect=true，这可以防御 CVE-2019-9153 中描述的数字签名绕过攻击。 许可证：MIT 版权所有 2019 Stéphane M. Catala...