st2-046-poc

Struts2 Content-Disposition ファイル名の nullバイト バリアント CVE-2017-5638 Struts2 Security Bulletin S2-046 リクエストの Content-Disposition ヘッダの filename フィールドに null バイト \x00 が含まれると、InvalidFileNameException が同じ（クライアントが制御する）ファイル名文字列でトリガーされ、その例外メッセージがエラー処理中に OGNL 評価を引き起こす可能性があります。これは、元の Content-Type ベクター（S2-045 で報告...

CVE-2020-5398

CVE-2020-5398 - Spring MVC용 RFDReflected File Download 공격 Spring Framework 5.2.x5.2.3 미만, 5.1.x5.1.13 미만, 5.0.x5.0.16 미만 버전에서 사용자 입력에서 파생된 filename 속성을 사용하여 응답에 'Content-Disposition' 헤더를 설정하는 애플리케이션은 RFD반영된 파일 다운로드 공격에 취약합니다. 사용 방법 1. root@kitploit: ./gradlew bootrun 127.0.0.1:8080에서 수신 대기. 2...

Better-CVE-2022-29464

更好的CVE-2022-29464 某些WSO2产品允许无限制的文件上传，导致远程代码执行。攻击者必须使用一个/fileupload端点，并带有Content-Disposition目录遍历序列，以到达web根目录下的一个目录，例如../../../../repository/deployment/server/webapps目录。 使用方法 root@kitploit: python3 main.py https://example.com shell.jsp 将 https://example.com 替换为易受攻击的服务器，并将 shell.jsp 替换为您要用于上传的文件名。...

Astra Linux – Vulnerability in libsoup2.4

A flaw was discovered in libsoup, where the soupmessageheadersgetcontentdisposition function is vulnerable to a NULL pointer dereference. This flaw allows a malicious HTTP peer to crash a libsoup client or server that uses this function...

Astra Linux – Vulnerability in ruby-sinatra

Sinatra is a domain-specific language for creating web applications in Ruby. A vulnerability was discovered in Sinatra 2.0 before versions 2.2.3 and 3.0 before version 3.0.4. The application is vulnerable to a reflected file download RFD attack, which causes the Content-Disposition header of a...

two-dots-and-a-slash-cve-2026-18907-tecno-hi-browser-download-path-traversal

CVE-2026-18907 — TECNO Hi Browser ダウンロードハンドラにおけるパストラバーサル CVE-2026-18907 （CVSS 7.5 High、CWE-23）の概念実証コードです。TECNO Hi Browser （com.talpa.hibrowser）バージョン 2.23.1.1 のダウンロードファイル機能 に存在する、相対 パストラバーサル脆弱性を実証します。当該ブラウザは攻撃者が制御する Content-Disposition...

WSOB

😭 WSOB CVE-2022-29464 😭 WSOB は、WSO2 に存在する CVE-2022-29464 として割り当てられた新しい脆弱性を悪用するために作成された Python ツールです。 CVE-2022-29464 の詳細: 特定の WSO2 製品では、無制限のファイルアップロードが許可されており、その結果としてリモートコード実行が可能になります。攻撃者は、../../../../repository/deployment/server/webapps ディレクトリなど、Web ルート配下のディレクトリに到達するために、Content-Disposition...

CVE-2026-45759

A flaw was found in Suricata, a network Intrusion Detection System IDS, Intrusion Prevention System IPS, and Network Security Monitoring NSM engine. A remote attacker could exploit this vulnerability by sending crafted HTTP traffic with large Content-Disposition headers. This could lead to...

Linux Distros Unpatched Vulnerability : CVE-2026-45759

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Surica...

DEBIAN-CVE-2026-45759

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata could repeatedly perform expensive parsing of large HTTP Content-Disposition headers during HTTP response body processing. Crafted HTT...

CVE-2026-45759

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata could repeatedly perform expensive parsing of large HTTP Content-Disposition headers during HTTP response body processing. Crafted HTT...

CVE-2026-45759 Suricata http1: quadratic Content-Disposition processing can lead to denial of service

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata could repeatedly perform expensive parsing of large HTTP Content-Disposition headers during HTTP response body processing. Crafted HTT...

CVE-2026-45759

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata could repeatedly perform expensive parsing of large HTTP Content-Disposition headers during HTTP response body processing. Crafted HTT...

CVE-2026-45759 Suricata http1: quadratic Content-Disposition processing can lead to denial of service

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata could repeatedly perform expensive parsing of large HTTP Content-Disposition headers during HTTP response body processing. Crafted HTT...

CVE-2026-45759

Suricata (a network IDS/IPS/NMS engine) is vulnerable to a denial of service via quadratic processing of large HTTP Content-Disposition headers during HTTP response body processing. Prior to versions 7.0.16 and 8.0.5 , crafted HTTP traffic can cause excessive CPU consumption with no impact on con...

EUVD-2026-75754

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata could repeatedly perform expensive parsing of large HTTP Content-Disposition headers during HTTP response body processing. Crafted HTT...

GHSA-H6CJ-26G5-67FV OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool

Summary Alist's offline-download feature POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL, fetches it, and saves the bytes under a per-task temp directory before transferring to the user's destination storage. The temp filename is taken from the response's...

OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool

Summary Alist's offline-download feature POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL, fetches it, and saves the bytes under a per-task temp directory before transferring to the user's destination storage. The temp filename is taken from the response's...

CVE-2026-75602

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...

CVE-2026-75602 OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...