CVE-2021-43798

CVE-2021-43798 1. Resumo Grafana é uma plataforma de código aberto que suporta monitoramento e gerenciamento de dados. Nas versões abaixo, existe uma vulnerabilidade de Path Traversal que permite manipular caminhos de arquivos usando caracteres especiais como ../. 8.0.0 ou superior, inferior a...

CVE-2022-22978

CVE 2022-22978: Bypass de Autorização no RegexRequestMatcher 🥶 Visão Geral De acordo com as informações que pesquisei, esta é uma vulnerabilidade relacionada à classe RegexRequestMatcher no framework Spring Security. Especificamente, aplicações que usam RegexRequestMatcher cuja expressão regular...

CVE-2026-78680

NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent.reprsvg, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can...

CVE-2026-72698

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by...

CVE-2026-78680

NLTK versions before 3.10.3 are vulnerable to arbitrary code execution via the Graphviz dot binary . The root cause is that dependencygraph.dot2img and AlignedSent._repr_svg_ invoke dot using a bare name rather than a validated absolute path. On Windows , an attacker can place a malicious dot bin...

CVE-2026-78680

NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent.reprsvg, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can...

EUVD-2026-65226

NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent.reprsvg, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can...

CVE-2026-78680 NLTK before 3.10.3 Arbitrary Code Execution via Graphviz dot Binary

NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent.reprsvg, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can...

CVE-2026-72698

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders. An attacker with page-content edit access (low privilege) can bypass the config_denied_paths restrictions by using dot notation in Twig templates, exposing raw configuration values inclu...

EUVD-2026-65212

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by...

CVE-2026-72698 Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by...

CVE-2002-0347

CVE-2002-0347 ثغرة اجتياز الدليل في Cobalt RAQ 4 تسمح للمهاجمين عن بُعد بقراءة الملفات المحمية بكلمة مرور، وربما الملفات خارج جذر الويب، عبر .. نقطتان في طلب HTTP. منشور Packetstorm على https://packetstormsecurity.com/files/25837/Colbalt-RAQ-v4.txt.html منشور SecurityFocus على...

CVE-2001-0931

CVE-2001-0931 La vulnerabilità di directory traversal in Cooolsoft PowerFTP Server 2.03 consente agli attaccanti di elencare o leggere file e directory arbitrari tramite .. dot dot in 1 LS o 2 GET. Pubblicazione SecurityFocus su https://www.securityfocus.com/bid/3593/info Pubblicazione Securiteam...

pytm

pytm: A Pythonic framework for threat modeling Introduction Traditional threat modeling too often comes late to the party, or sometimes not at all. In addition, creating manual data flows and reports can be extremely time-consuming. The goal of pytm is to shift threat modeling to the left, making...

Le Panthéon de la Souveraineté

🏠 Sviluppato su: GitLab | 🪞 Mirror automatico su: GitHub 🏛️ Il Pantheon della Sovranità Un'infrastruttura cloud 100% sovrana, ridondante e sicura, progettata per affrancarsi totalmente dalle GAFAM. Versione 1.1: Base di rete privata, crittografia delle richieste DNS dei server DoT e architettura d...

dns-benchmark-tool

⚠️ questo progetto è stato spostato e non è più mantenuto. installa il successore: pip install net-benchmark repository: https://github.com/net-benchmark/net-benchmark tutti i comandi e flag esistenti rimangono completamente compatibili. DNS Benchmark Tool Parte di BuildTools - Network Performance...

OSEC-2026-16 Path traversal in Cohttp.Path.resolve_local_file

The issue is that the function normalizes the URI path before percent decoding it: OCaml let resolvelocalfile docroot uri = let path = Uri.pctdecode path resolve "http" ofstring "/" uri in ... Because %2f is decoded after Uri.resolve, encoded separators survive dot-segment normalization. For...

CVE-2026-48099 WsgiDAV encoded dot segments can escape filesystem share roots

WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4...

CVE-2026-48099

CVE-2026-48099 - WsgiDAV directory traversal via encoded dot segments WsgiDAV

CVE-2026-48099 WsgiDAV encoded dot segments can escape filesystem share roots

WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4...