st2-046-poc

Struts2 Content-Disposition filename null-byte 변종 CVE-2017-5638 Struts2 보안 게시판 S2-046 요청의 Content-Disposition 헤더 filename 필드에 널 바이트\x00가 포함되면 InvalidFileNameException이 발생할 수 있으며, 예외 메시지에 포함된 클라이언트가 제어하는 filename 문자열이 오류 처리 중 OGNL 평가를 유발하는 데 사용될 수 있습니다. 이는 원래 S2-045에서 보고된 Content-Type 벡터 및 S2-046에...

Better-CVE-2022-29464

Better CVE-2022-29464 Некоторые продукты WSO2 допускают неограниченную загрузку файлов, приводящую к удаленному выполнению кода. Атакующий должен использовать конечную точку /fileupload с последовательностью обхода каталогов в Content-Disposition, чтобы достичь каталога внутри веб-корня, например...

two-dots-and-a-slash-cve-2026-18907-tecno-hi-browser-download-path-traversal

CVE-2026-18907 — TECNO Hi Browser ダウンロードハンドラにおけるパストラバーサル CVE-2026-18907 （CVSS 7.5 High、CWE-23）の概念実証コードです。TECNO Hi Browser （com.talpa.hibrowser）バージョン 2.23.1.1 のダウンロードファイル機能 に存在する、相対 パストラバーサル脆弱性を実証します。当該ブラウザは攻撃者が制御する Content-Disposition...

WSOB

😭 WSOB CVE-2022-29464 😭 WSOB は、WSO2 に存在する CVE-2022-29464 として割り当てられた新しい脆弱性を悪用するために作成された Python ツールです。 CVE-2022-29464 の詳細: 特定の WSO2 製品では、無制限のファイルアップロードが許可されており、その結果としてリモートコード実行が可能になります。攻撃者は、../../../../repository/deployment/server/webapps ディレクトリなど、Web ルート配下のディレクトリに到達するために、Content-Disposition...

CVE-2026-45759

A flaw was found in Suricata, a network Intrusion Detection System IDS, Intrusion Prevention System IPS, and Network Security Monitoring NSM engine. A remote attacker could exploit this vulnerability by sending crafted HTTP traffic with large Content-Disposition headers. This could lead to...

DEBIAN-CVE-2026-45759

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata could repeatedly perform expensive parsing of large HTTP Content-Disposition headers during HTTP response body processing. Crafted HTT...

CVE-2026-45759

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata could repeatedly perform expensive parsing of large HTTP Content-Disposition headers during HTTP response body processing. Crafted HTT...

CVE-2026-45759 Suricata http1: quadratic Content-Disposition processing can lead to denial of service

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata could repeatedly perform expensive parsing of large HTTP Content-Disposition headers during HTTP response body processing. Crafted HTT...

CVE-2026-45759 Suricata http1: quadratic Content-Disposition processing can lead to denial of service

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata could repeatedly perform expensive parsing of large HTTP Content-Disposition headers during HTTP response body processing. Crafted HTT...

CVE-2026-45759

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata could repeatedly perform expensive parsing of large HTTP Content-Disposition headers during HTTP response body processing. Crafted HTT...

CVE-2026-45759

Suricata (a network IDS/IPS/NMS engine) is vulnerable to a denial of service via quadratic processing of large HTTP Content-Disposition headers during HTTP response body processing. Prior to versions 7.0.16 and 8.0.5 , crafted HTTP traffic can cause excessive CPU consumption with no impact on con...

EUVD-2026-75754

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata could repeatedly perform expensive parsing of large HTTP Content-Disposition headers during HTTP response body processing. Crafted HTT...

CVE-2020-5398

CVE-2020-5398 - Spring MVC 向け RFDReflected File Download 攻撃 Spring Framework の 5.2.x 系で 5.2.3 未満、5.1.x 系で 5.1.13 未満、および 5.0.x 系で 5.0.16 未満のバージョンでは、レスポンスの “Content-Disposition” ヘッダーを設定する際に、その filename 属性がユーザー入力から取得される場合、アプリケーションは reflected file download RFD 攻撃に対して脆弱になります。 使い方 1. root@kitploit:...

OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool

Summary Alist's offline-download feature POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL, fetches it, and saves the bytes under a per-task temp directory before transferring to the user's destination storage. The temp filename is taken from the response's...

GHSA-H6CJ-26G5-67FV OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool

Summary Alist's offline-download feature POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL, fetches it, and saves the bytes under a per-task temp directory before transferring to the user's destination storage. The temp filename is taken from the response's...

CVE-2026-75602

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...

CVE-2026-75602 OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...

EUVD-2026-70550

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...

CVE-2026-75602 OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...

CVE-2026-75602

OpenList (a file list program supporting multiple storage backends) versions prior to 4.2.3 are affected by an authenticated path traversal vulnerability in the offline-download feature. When the SimpleHttp tool is used via POST /api/fs/add_offline_download, an attacker-controlled Content-Disposi...