Rocky Linux 10.0 [CIQ] Security Update: libsoup3 / libsoup3-debuginfo / libsoup3-debugsource / etc Multiple Vulnerabilities (crlsa-2025_8128)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20258128 advisory. libsoup: Denial of Service attack to websocket server CVE-2025-32049 libsoup: Denial of service in server when client requests a large amount of...

onedrive_user_enum

onedriveuserenum v2.10 enumerate valid onedrive users For a full rundown of the enumeration technique and OneDrive enum, check out the blog here: https://www.trustedsec.com/blog/onedrive-to-enum-them-all/ If you are looking for the old, non-database vesion of OneDrive Enum, you can find it here:...

adaPwn

adaPwn - CVE-2019-14912 PoC adAS OPENSSO 모듈이 리다이렉트할 도메인을 올바르게 검증하지 않아, 사용자를 공격자가 제어하는 웹사이트로 리다이렉트하고, 그의 adAS 세션 쿠키를 탈취할 수 있습니다. 사용법 usage: adaPwn.py -h --interface INTERFACE --httpPort HTTPPORT --dnsPort DNSPORT ipToSpoof realIP redirectUrl ipBlacklist ipBlacklist...

CVE-2026-100187

The Onion module in the AIL Framework is vulnerable to a logic flaw in its URL extraction process. The software uses a performance shortcut that validates .onion targets based only on a 69-character length and a ".onion" suffix , failing to perform proper hostname parsing or domain validation. An...

CVE-2026-100187 AIL Framework Onion Module: Non-Onion URL Accepted as Crawler Task Due to Bypassed Domain Validation

The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as valid .onion targets based solely on a length check exactly 69 characters and a suffix check ending in ".onion", without performing proper hostname parsing or onion-domain...

CVE-2026-100187 AIL Framework Onion Module: Non-Onion URL Accepted as Crawler Task Due to Bypassed Domain Validation

The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as valid .onion targets based solely on a length check exactly 69 characters and a suffix check ending in ".onion", without performing proper hostname parsing or onion-domain...

CVE-2026-92597

A flaw was found in Nodemailer. This vulnerability allows a remote attacker to bypass email domain validation due to incorrect parsing of RFC 5322 comments in email addresses. Specifically, a malformed comment can cause Nodemailer to misinterpret the recipient's domain, leading to the delivery of...

CVE-2026-92597 Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment

Nodemailer versions = 6.9.16 and 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surrounding the comment instead of treating the comment as folding whitespace that...

CVE-2026-92597 Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment

Nodemailer versions = 6.9.16 and 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surrounding the comment instead of treating the comment as folding whitespace that...

Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

When processing a Set-Cookie from a response, the CookieJar client middleware trusts the server-supplied Domain attribute verbatim, with no check that it domain-matches the host that sent the cookie RFC6265 §5.3 step 6 and no public suffix check. A malicious or compromised server can therefore...

GHSA-WV64-J4FQ-5F9X Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

When processing a Set-Cookie from a response, the CookieJar client middleware trusts the server-supplied Domain attribute verbatim, with no check that it domain-matches the host that sent the cookie RFC6265 §5.3 step 6 and no public suffix check. A malicious or compromised server can therefore...

CVE-2026-69214

Http4s , a Scala library for HTTP services, is affected through its CookieJar client middleware . Prior to 0.23.35 and 1.0.0-M47 , the middleware stores a response cookie's Domain attribute without validating that it domain-matches the supplying host or rejecting public suffixes. A malicious or c...

CVE-2026-69214 Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server...

CVE-2026-69214 Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server...

EUVD-2026-79179

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server...

CVE-2026-85676

A flaw was found in Dub. This open redirect vulnerability exists in the redirurl query parameter, which is accepted on every short link without validation or domain allowlist enforcement. A remote attacker can exploit this by appending the redirurl parameter to any short link. This allows the...

Astra Linux – Vulnerability in python-tornado

In Tornado before version 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments of .RequestHandler.setcookie were not checked for crafted characters...

Astra Linux – Vulnerability in Pypy

In the http.cookiejar.py module of Python, prior to version 3.7.3, the domain validation mechanism was not properly implemented. This vulnerability could allow existing cookies to be sent to the wrong server. Attackers could exploit this flaw by using a server whose hostname contains another vali...

Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain

Summary Nodemailer's email-address parser treats an RFC 5322 comment ... inside the domain as a point to concatenate the surrounding text, rather than as folding whitespace CFWS that terminates the domain. Consequently a recipient address such as [email protected] is parsed and delivere...

GHSA-CC9R-2J5M-2M83 Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain

Summary Nodemailer's email-address parser treats an RFC 5322 comment ... inside the domain as a point to concatenate the surrounding text, rather than as folding whitespace CFWS that terminates the domain. Consequently a recipient address such as [email protected] is parsed and delivere...