tcpdump

TCPDUMP 4.x.y por The Tcpdump Group Para reportar un problema de seguridad, envía un correo electrónico a [email protected]. Para reportar errores y otros problemas, contribuir con parches, solicitar una funcionalidad, proporcionar comentarios generales, etc., consulta las pautas para...

Ruby Dragonfly <1.4.0 - Remote Code Execution

Ruby Dragonfly before 1.4.0 contains an argument injection vulnerability that allows remote attackers to read and write to arbitrary files via a crafted URL when the verifyurl option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishand...

Dragonfly2 < 2.1.0-beta.1 - Hardcoded JWT Secret

Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation CNCF as an Incubating Level Project. Dragonfly uses JWT to verify user. However, the secret key for JWT, "Secret Key", is hard coded, which leads to...

CVE-2021-33564

CVE-2021-33564 PoC Exploit script for CVE-2021-33564 Argument Injection in Dragonfly Ruby Gem. Usage Arbitrary File Read python3 poc.py -u https:///system/refinery/images -r /etc/passwd Arbitrary File Write python3 poc.py -u https:///system/refinery/images -w public/test.txt -c test.txt -lu http:...

CVE-2021-33564

CVE-2021-33564 PoC Script de explotación para CVE-2021-33564 Inyección de argumentos en la gema Ruby Dragonfly. Uso Lectura arbitraria de archivos python3 poc.py -u https:///system/refinery/images -r /etc/passwd Escritura arbitraria de archivos python3 poc.py -u https:///system/refinery/images -w...

CVE-2026-54637

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4-rc.3, the scheduler's default unauthenticated v1 gRPC flow accepts attacker-controlled PeerHost.Ip and PeerHost.DownPort values through RegisterPeerTask and ReportPeerResult, storeHost copies tho...

CVE-2026-49254

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc or RBAC, while manager/handlers/oauth.go returns models.Oauth records and...

CVE-2026-49254

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc or RBAC, while manager/handlers/oauth.go returns models.Oauth records and...

EUVD-2026-78577

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc or RBAC, while manager/handlers/oauth.go returns models.Oauth records and...

CVE-2026-54637

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4-rc.3, the scheduler's default unauthenticated v1 gRPC flow accepts attacker-controlled PeerHost.Ip and PeerHost.DownPort values through RegisterPeerTask and ReportPeerResult, storeHost copies tho...

CVE-2026-62357

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40.0, CMS.INITBYDIM and CMS.INITBYPROB accept dimensions whose width times depth times sizeofint64t overflows in src/core/cms.cc, allocating an undersized counter buffer while CMS.INCRBY and CMS.QUERY use the...

EUVD-2026-60960

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40.0, CMS.INITBYDIM and CMS.INITBYPROB accept dimensions whose width times depth times sizeofint64t overflows in src/core/cms.cc, allocating an undersized counter buffer while CMS.INCRBY and CMS.QUERY use the...

CVE-2026-62357

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40.0, CMS.INITBYDIM and CMS.INITBYPROB accept dimensions whose width times depth times sizeofint64t overflows in src/core/cms.cc, allocating an undersized counter buffer while CMS.INCRBY and CMS.QUERY use the...

PT-2026-77152

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40.0, CMS.INITBYDIM and CMS.INITBYPROB accept dimensions whose width times depth times sizeofint64 t overflows in src/core/cms.cc, allocating an undersized counter buffer while CMS.INCRBY and CMS.QUERY use the...

SUSE CVE-2025-59353

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, a peer can obtain a valid TLS certificate for arbitrary IP addresses, effectively rendering the mTLS authentication useless. The issue is that the Manager's Certificate gRPC service does not...

GO-2026-5901 Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth in d7y.io/dragonfly

Dragonfly Manager OAuth provider clientsecret disclosure via unauthenticated GET /api/v1/oauth in d7y.io/dragonfly...

GO-2026-5910 Dragonfly scheduler v1 and v2 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile in d7y.io/dragonfly

Dragonfly scheduler v1 and v2 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile in d7y.io/dragonfly...

CVE-2026-54709

creationtimestamp| type| source ---|---|--- 2026-07-06 22:35:29+00:00| published-proof-of-concept| https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-fhf9-m53m-863g...

CVE-2026-54637

creationtimestamp| type| source ---|---|--- 2026-07-06 22:35:14+00:00| published-proof-of-concept| https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-chwm-m7g7-685g...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the DownloadTinyFile process when the scheduler's gRPC service accepts attacker-controlled values for PeerHost.Ip and PeerHost.DownPort without proper validation. An attacker can cause the scheduler t...