EUVD-2026-76915

SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authentication is configured and MFA is enforced, an attacker can create a second OTP access capability. SEP sesam and Active Directory handle username capitalization differently, which may allow multiple SEP sesam user...

CVE-2026-79300

SEP sesam before 5.2.0.24 mishandles user authorization when combined with Active Directory (AD) authentication and enforced multi-factor authentication (MFA) . The root cause is a case-sensitivity mismatch : Active Directory treats usernames as case-insensitive, while SEP sesam distinguishes let...

CVE-2026-89012

CVE-2026-89012 — Dolibarr SQL 필터 거부 목록 우회 CVE-2026-89012 익스플로잇: forgeSQLFromUniversalSearchCriteria의 금지 필드 거부 목록 CVE-2026-71510 수정과 함께 도입됨은 대소문자를 구분하는 inarray를 사용하지만, 피연산자 문자 집합은 A-Z를 허용한다. SQL 컬럼 해석은 대소문자를 구분하지 않으므로, 인증된 API 사용자는 t.passcrypted 대신 t.PASSCRYPTED를 조회하여 거부 목록을 우회할 수 있다. 접두사 LIKE 조건자...

monstra_cms-3.0.4--getshell

monstracms-3.0.4--getshell monstracms-3.0.4-업로드 getshell CVE- 2018-17418 코드 분석（Code analysis）： monstra\plugins\box\filesmanager\ filesmanager.admin.php의 150행에 블랙리스트 제한을 수행하는 forbiddentypes 변수가 있습니다. 이 변수를 계속 추적합니다. monstra\plugins\box\filesmanager\ filesmanager.admin.php의 150행에 블랙리스트로 지정된...

running-CVE-2024-32002-locally-for-tesing

Мы адаптируем это для локального использования Мы следуем этой записи в блоге, но с некоторыми ключевыми отличиями https://amalmurali.me/posts/git-rce Как это работает 1. Зловредный репозиторий gitrce включает подмодуль с особым образом созданным путём. 2. Путь подмодуля использует вариацию...

CVE-2026-9086-poc

CVE-2026-9086: Keycloak URI 스킴 검증 우회 XSS PoC 영어 버전 개요 이 리포지토리는 Keycloak 의 클라이언트 URI 검증에 존재하는 XSSCross-Site Scripting 취약점 CVE-2026-9086 의 Proof of Concept PoC입니다. 취약한 Keycloak은 클라이언트에 설정되는 URI의 javascript: 및 data: 스킴을 대소문자를 구분하여 검증했습니다. 그 때문에 jaVaSCript:나 DaTa: 같은 혼합 표기를 사용하면 금지 스킴의 검증을 우회할 수 있습니다...

BIT-TOMCAT-2026-43513 Apache Tomcat: LockOutRealm treats user names as case-sensitive

Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.21, from 10.1.0 through 10.1.54, from 9.0.0 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also...

CVE-2026-86770

Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4unicodeci database collation t...

EUVD-2026-74947

Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4unicodeci database collation t...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

Linux Distros Unpatched Vulnerability : CVE-2026-82067

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default...

UBUNTU-CVE-2026-82067

Improper handling of case sensitivity in the configuration validation...

CVE-2026-82067

Improper handling of case sensitivity in the configuration validation...

CVE-2026-82067

Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform...

EUVD-2026-72954

Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform...

CVE-2026-82067

MongoDB Server is affected by an improper handling of case sensitivity in its configuration validation component , which may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated attacker with network access to a deployment in this condi...

CVE-2026-82067 Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup

Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform...

Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup

Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

PT-2026-87160

Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform...