Lucene search
+L

1748 matches found

CNNVD
CNNVD
added 2026/04/07 12:00 a.m.23 views

FTL 注入漏洞

FTL is an open-source network advertising interception and statistics tool developed by Pi-hole. Versions of FTL from 6.0 to 6.6 had a injection vulnerability. This vulnerability stemmed from the DNS CNAME record configuration parameters, allowing authenticated attackers to inject arbitrary dnsma...

8.8CVSS6AI score0.00686EPSS
SaveExploits1References1
Positive Technologies
Positive Technologies
added 2026/04/03 12:00 a.m.31 views

PT-2026-30229

Name of the Vulnerable Software and Affected Versions prompts.chat versions prior to commit 1464475 Description prompts.chat is susceptible to an identity confusion issue stemming from inconsistent case sensitivity in username handling during write and read operations. This allows attackers to...

8.6CVSS5.9AI score0.00332EPSS
SaveExploits1References10
OSV
OSV
added 2026/04/02 6:42 p.m.14 views

GO-2026-4893 Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField in github.com/traefik/traefik

Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField in github.com/traefik/traefik...

8.8CVSS5.9AI score0.00469EPSS
SaveExploits1References5
Positive Technologies
Positive Technologies
added 2026/04/02 12:00 a.m.15 views

PT-2026-29940

Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField in github.com/traefik/traefik...

5CVSS5.9AI score0.00469EPSS
SaveExploits1References6
SUSE CVE
SUSE CVE
added 2026/03/30 11:28 p.m.11 views

SUSE CVE-2026-33433

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3, when headerField is configured with a non-canonical HTTP header name e.g., x-auth-user instead of X-Auth-User, an authenticated attacker can inject their own canonical version of that header to...

8.8CVSS5.9AI score0.00469EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
added 2026/03/27 10:33 p.m.8 views

CVE-2026-33433

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. When the headerField is configured with a non-canonical HTTP header name, an authenticated attacker can inject a canonical version of that header. This allows the attacker to impersonate any identity to the backend, leading to ...

8.8CVSS5.8AI score0.00469EPSS
SaveExploits1References7
RedhatCVE
RedhatCVE
added 2026/03/27 9:52 p.m.13 views

CVE-2026-33895

A flaw was found in Forge also called node-forge, a JavaScript library used for Transport Layer Security TLS. The library's Ed25519 signature verification process does not correctly validate cryptographic signatures, allowing forged non-canonical signatures to be accepted. A remote attacker could...

7.5CVSS5.8AI score0.00543EPSS
SaveExploits0References6
NVD
NVD
added 2026/03/27 9:17 p.m.11 views

CVE-2026-33895

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order S = L. A valid signature and its S + L variant...

7.5CVSS0.00543EPSS
SaveExploits0References10
UbuntuCve
UbuntuCve
added 2026/03/27 9:17 p.m.9 views

CVE-2026-33895

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order S = L. A valid signature and its S + L variant...

7.5CVSS5.7AI score0.00543EPSS
SaveExploits0References4
CVE
CVE
added 2026/03/27 8:47 p.m.146 views

CVE-2026-33895

Summary: CVE-2026-33895 affects Forge (node-forge) prior to 1.4.0, where Ed25519 signature verification does not enforce S

7.5CVSS6.6AI score0.00543EPSS
SaveExploits0References10Affected Software1
EUVD
EUVD
added 2026/03/27 8:35 p.m.10 views

EUVD-2026-16616

Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField...

5CVSS5.9AI score0.00469EPSS
SaveExploits1References5
Github Security Blog
Github Security Blog
added 2026/03/27 8:35 p.m.31 views

Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField

Summary There is a potential vulnerability in Traefik's Basic and Digest authentication middlewares when headerField is configured with a non-canonical HTTP header name. An authenticated attacker with valid credentials can inject the canonical version of the configured header to impersonate any...

8.8CVSS5.9AI score0.00469EPSS
SaveExploits1References6Affected Software2
OSV
OSV
added 2026/03/27 8:35 p.m.16 views

GHSA-QR99-7898-VR7C Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField

Summary There is a potential vulnerability in Traefik's Basic and Digest authentication middlewares when headerField is configured with a non-canonical HTTP header name. An authenticated attacker with valid credentials can inject the canonical version of the configured header to impersonate any...

5CVSS5.9AI score0.00469EPSS
SaveExploits1References6
NVD
NVD
added 2026/03/27 3:16 p.m.17 views

CVE-2026-33433

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3, when headerField is configured with a non-canonical HTTP header name e.g., x-auth-user instead of X-Auth-User, an authenticated attacker can inject their own canonical version of that header to...

8.8CVSS0.00469EPSS
SaveExploits1References8
OSV
OSV
added 2026/03/27 1:49 p.m.15 views

CVE-2026-33433 Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3, when headerField is configured with a non-canonical HTTP header name e.g., x-auth-user instead of X-Auth-User, an authenticated attacker can inject their own canonical version of that header to...

5CVSS5.9AI score
SaveExploits0References10
Vulnrichment
Vulnrichment
added 2026/03/27 1:49 p.m.4 views

CVE-2026-33433 Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3, when headerField is configured with a non-canonical HTTP header name e.g., x-auth-user instead of X-Auth-User, an authenticated attacker can inject their own canonical version of that header to...

5CVSS5.9AI score0.00469EPSS
SaveExploits1References4
CVE
CVE
added 2026/03/27 1:49 p.m.68 views

CVE-2026-33433

CVE-2026-33433 affects Traefik prior to 2.11.42, 3.6.11, and 3.7.0-ea.3. A vulnerability in the BasicAuth/DigestAuth middlewares arises when headerField is configured with a non-canonical HTTP header name (for example x-auth-user). An authenticated attacker can inject a canonical version of that ...

8.8CVSS5.9AI score0.00469EPSS
SaveExploits1References8Affected Software1
AlpineLinux
AlpineLinux
added 2026/03/27 1:49 p.m.17 views

CVE-2026-33433

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3, when headerField is configured with a non-canonical HTTP header name e.g., x-auth-user instead of X-Auth-User, an authenticated attacker can inject their own canonical version of that header to...

8.8CVSS5.9AI score0.00469EPSS
SaveExploits1References4
Cvelist
Cvelist
added 2026/03/27 1:49 p.m.32 views

CVE-2026-33433 Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3, when headerField is configured with a non-canonical HTTP header name e.g., x-auth-user instead of X-Auth-User, an authenticated attacker can inject their own canonical version of that header to...

5CVSS0.00469EPSS
SaveExploits1References4
ATTACKERKB
ATTACKERKB
added 2026/03/27 1:49 p.m.10 views

CVE-2026-33433

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3, when headerField is configured with a non-canonical HTTP header name e.g., x-auth-user instead of X-Auth-User, an authenticated attacker can inject their own canonical version of that header to...

5CVSS5.9AI score0.00469EPSS
SaveExploits1References5Affected Software1
Rows per page
Query Builder