cve-2018-10933

CVE-2018-10933 CVE-2018-10933 libssh 인증 우회, 포트 2222에서 수신 대기하는 취약한 Docker 컨테이너입니다. 악용을 위해 기본 "myuser"/"mypassword"를 사용하여 로그인하십시오. Docker 컨테이너의 libssh 사본에 패치가 적용되어 SSH2MSGUSERAUTHSUCCESS 패킷을 모든 인증 시도keyboard-interactive/pubkey/gss-api 등에 주입하고 클라이언트 측 상태를 진행하도록 설정합니다. 포함된 서버는 악용이 성공할 수 있도록 예제 코드에서...

CVE-2018-10933

CVE-2018-10933의 POC libssh의 서버 측 상태 머신에서 0.7.6 및 0.8.4 이전 버전에 취약점이 발견되었습니다. 악의적인 클라이언트가 먼저 인증을 수행하지 않고 채널을 생성할 수 있어 무단 액세스가 발생할 수 있습니다. 사용법 : python3 libssh.py -s SERVERADD -u USERNAME -c COMMMANDTOEXEC 원본 권고 세부 정보: Peter Winter-Smith는 libssh가 서버로 사용될 때 인증을 잘못 처리한다는 사실을 발견했습니다. 원격 공격자는 이 문제를 이용해 ...

CVE-2018-10933

CVE-2018-10933 libssh의 서버 측 상태 머신에서 버전 0.7.6 및 0.8.4 이전에 취약점이 발견되었습니다. 악의적인 클라이언트가 먼저 인증을 수행하지 않고 채널을 생성하여 무단 액세스가 가능했습니다. 세부 정보 이 문제는 libssh가 인증 상태를 유지하지 않는 방식과 이를 이용해 인증을 우회할 수 있는 방법에서 비롯됩니다. 기본적으로 연결을 다단계 프로세스step1, step2, step3...로 생각해 보십시오. libssh는 단계의 순서를 강제하지 않기 때문에 step1과 step2를 거치지 않고...

Double Free

Overview Affected versions of this package are vulnerable to Double Free in QRX handling during channel creation failure. An attacker can trigger heap corruption and terminate the QUIC server process by sending a malformed INITIAL packet that makes portbindchannel fail after QRX allocation and...

CVE-2026-18798

Issue summary: QUIC server may double free QRX QUIC record layer RX object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence...

CVE-2026-74608

A flaw was found in the Server Message Block SMB client of the Linux kernel. A use-after-free vulnerability exists in the cifstryaddingchannels function. This occurs when a concurrent interface list refresh removes a reference to an interface while a channel creation is in progress and fails,...

CVE-2026-74608

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifstryaddingchannels cifstryaddingchannels takes a temporary reference to an interface before dropping ifacelock. If cifssesaddchannel fails, it drops that reference and then increments...

AZL-97124 CVE-2026-74608 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifstryaddingchannels cifstryaddingchannels takes a temporary reference to an interface before dropping ifacelock. If cifssesaddchannel fails, it drops that reference and then increments...

CVE-2026-74608

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifstryaddingchannels cifstryaddingchannels takes a temporary reference to an interface before dropping ifacelock. If cifssesaddchannel fails, it drops that reference and then increments...

Server-side Request Forgery (SSRF)

Overview phanan/koel is a personal audio streaming service. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the createPodcastChannel.view process. An attacker can cause the server to initiate HTTP requests to internal or private network resources by...

Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation

Summary Koel v9.6.0 protects the regular podcast subscription API with SafeUrl, but the Subsonic-compatible createPodcastChannel.view route does not apply the same protection. An authenticated user can supply a private URL and cause Koel to fetch it server-side during podcast parsing. This was...

Open WebUI's Channel Access Grants Bypass filter_allowed_access_grants

Channel Access Grants Bypass filterallowedaccessgrants Affected ComponentChannel creation and update endpoints:- backend/openwebui/routers/channels.py lines 291-340, createnewchannel- backend/openwebui/routers/channels.py lines 617-638, updatechannelbyid- backend/openwebui/models/channels.py line...

PT-2026-59355

Channel Access Grants Bypass filter allowed access grants Affected Component Channel creation and update endpoints: - backend/open webui/routers/channels.py lines 291-340, create new channel - backend/open webui/routers/channels.py lines 617-638, update channel by id - backend/open...

EUVD-2026-40430

Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoint that allows authenticated users to overwrite existing channels by reusing their names. Attackers with app.createchannel permission can exploit a logic mismatch between existence validation and...

CVE-2026-56249

Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoint that allows authenticated users to overwrite existing channels by reusing their names. Attackers with app.createchannel permission can exploit a logic mismatch between existence validation and...

CVE-2026-56249 Capgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name Collision

Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoint that allows authenticated users to overwrite existing channels by reusing their names. Attackers with app.createchannel permission can exploit a logic mismatch between existence validation and...

CVE-2026-56249

Capgo before 12.128.2 has an authorization bypass in the channel creation endpoint that lets authenticated users overwrite existing channels by reusing names. Attackers with app.create_channel permission can exploit a logic mismatch between existence validation and upsert operations to reassign c...

CVE-2026-56249 Capgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name Collision

Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoint that allows authenticated users to overwrite existing channels by reusing their names. Attackers with app.createchannel permission can exploit a logic mismatch between existence validation and...

CVE-2026-56249 Capgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name Collision

Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoint that allows authenticated users to overwrite existing channels by reusing their names. Attackers with app.createchannel permission can exploit a logic mismatch between existence validation and...

PT-2026-54026

Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoint that allows authenticated users to overwrite existing channels by reusing their names. Attackers with app.create channel permission can exploit a logic mismatch between existence validation and...