CVE-2021-41773-i-

CVE-2021-41773 CVE-2021-41773 POC con Docker Configuración Para personalizar el archivo httpd.conf, cambie la línea 251 en la sección de Require all denied a Require all granted. AllowOverride none Require all granted Crear un Dockerfile en tu proyecto FROM httpd:2.4.49 COPY ./httpd.conf...

CVE-2021-41773

CVE-2021-41773 CVE-2021-41773 POC with Docker Configuration To customize the httpd.conf file, change line 251 in the section from Require all denied to Require all granted. root@kitploit: AllowOverride none Require all granted Create a Dockerfile in your project root@kitploit: FROM httpd:2.4.49...

Open WebUI 'LDAP Empty Password' - Authentication Bypass

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accep...

CVE-2018-6574

CVE-2018-6574...

EUVD-2026-83411

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to traverse directories on the system due to a path traversal vulnerability...

Astra Linux – Vulnerability in Zabbix

The request to LDAP is sent before checking the user permissions...

Astra Linux – Vulnerability in Samba

A vulnerability related to information leaks was discovered in Samba’s LDAP server. Due to missing access control checks, a authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store...

Astra Linux – Vulnerability in Bouncycastle

The Bouncy Castle For Java version prior to 1.74 is affected by an LDAP injection vulnerability. This vulnerability only affects applications that use the LDAP CertStore provided by Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the...

Astra Linux – Vulnerability in Derby

A cleverly designed username can bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could allow an attacker to create unnecessary Derby databases, thereby filling up storage space. In LDAP-authenticated Derby installations, the attacker could also execute malware...

Astra Linux – Vulnerability in curl

There is an improper authentication vulnerability in curl versions 7.33.0 through and including 7.82.0. This vulnerability may allow for the reuse of OAUTH2-authenticated connections without ensuring that the connection was authentically verified with the same credentials used for this transfer...

CVE-2025-70820

Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder...

EUVD-2026-38208

Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion...

CVE-2026-73787

A vulnerability in the CPPM web interface could allow an authenticated remote attacker to access directory information on a vulnerable system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-14505

Tanium addressed a path traversal vulnerability in Tanium Data Service...

EUVD-2026-74034

Adobe Commerce is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to access unauthorized files or directories outside the...

ROS-20260907-73-0513

The vulnerability in perl-Convert-ASN1 relates to the use of files and directories accessible from external parties. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

ROS-20260907-73-0027

The vulnerability in perl-DBI is related to an incorrect limitation on the path to the restricted access directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

PT-2026-86820

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Next4Biz Information Technologies Inc. CSM Customer Service Management allows Path Traversal. This issue affects CSM Customer Service Management: from 6.8.9 through 07092026. NOTE: The vendor was contact...

EUVD-2026-71956

AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root. Attackers can connect to the exposed communication port and execute arbitrary bash commands within the container, gaining acces...

CVE-2026-74994

The modauth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid for all...