CVE-2025-46822

CVE-2025-46822 인증되지 않은 절대 경로를 통한 임의 파일 읽기 설명: Path.resolve 메서드가 경로 탐색을 방지하기 위해 사용되고 있지만, 절대 경로를 사용하면 내부 파일을 성공적으로 읽을 수 있음을 발견했습니다. 또한 엔드포인트가 인증되지 않았으므로 누구나 조직의 전체 파일, 파일 시스템을 읽을 수 있습니다. 이는 application-dev.properties에 구성된 저장소 루트files.store.root = /file-store/에서의 접근을 허용하여 민감한 내부 파일에 대한 무단 접근을 가능하게...

gapps

Gapps Gapps는 다양한 보안 프레임워크에 대한 진행 상황을 쉽게 추적할 수 있는 보안 규정 준수 플랫폼입니다. ❄️ Gapps 사이트 보기 🏠 연락에 관심이 있으신가요? 디스코드에 가입해 주세요. 목차 1. 시작하기 2. FAQ 새로운 기능 ❄️ SOC2, NIST CSF, NIST-800-53, CMMC, HIPAA, ASVS, ISO27001, CSC CIS18, PCI DSS 및 SSF가 추가되었습니다! 총 10개의 프레임워크입니다. 멀티 테넌시, OIDC SSO 감사자와의 협업 위험 등록부 파일 저장을 위한...

PrivateSphare

PrivateSphare PrivateSphare는 안전하고 익명의 영지식 파일 저장 및 공유 플랫폼입니다. 사용자는 파일을 업로드하고 검색을 위해 사람이 읽을 수 있는 24단어 암호를 받을 수 있습니다. 계정이 없고, 추적이 없으며, 암호화되지 않은 데이터는 서버의 영구 저장소에 절대 닿지 않습니다. 🛡️ 주요 기능 포스트퀀텀 보안 : 파일은 양자 안전 하이브리드 방식Kyber1024 + AES-256-GCM으로 암호화되어 미래의 양자 컴퓨터 위협으로부터 보호합니다. 영지식 암호화 : 파일은 24단어 BIP-39 암호에서 파생...

Payload: Incomplete validation during the upload file lifecycle

Impact Under certain conditions, an authenticated user with permission to modify uploads could cause unintended files to be removed during file cleanup. This may result in data loss or service disruption. You are affected if: - You use Payload upload collections with local file storage. - Untrust...

GHSA-P223-2WR2-J562 Payload: Incomplete validation during the upload file lifecycle

Impact Under certain conditions, an authenticated user with permission to modify uploads could cause unintended files to be removed during file cleanup. This may result in data loss or service disruption. You are affected if: - You use Payload upload collections with local file storage. - Untrust...

Astra Linux – Vulnerability in git-lfs

Git LFS is an extension of Git for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host’s URL to the git-credential1 command without checking for embedded line-ending control characters. It then sends any credentials it receives back...

coolify-cve-2025-66209-66213

Coolify 보안 권고 - CVE-2025-66209 CVE-2025-66213 보고자: 0xrakan 공급업체: coollabsio/coolify 영향받는 버전: v4.0.0-beta.451 수정된 버전: v4.0.0-beta.451 심각도: 치명적 CVSS 9.4 개요 Coolify에서 다섯 가지 치명적인 인증된 명령 삽입 취약점이 발견되었습니다. 이 취약점은 애플리케이션/서비스 관리 권한을 가진 인증된 사용자가 관리 서버에서 루트 권한으로 임의 명령을 실행할 수 있게 하여, 컨테이너 탈출 및 호스트 시스템 전체 손상으로...

CVE-2026-92994

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript...

CVE-2026-92994

The Verge3D Publishing and E-Commerce WordPress plugin before version 4.13.1 is vulnerable to unauthenticated Stored XSS . The flaw exists because the plugin's file storage feature fails to validate the contents of uploaded files and serves them back with an attacker-controlled content type. This...

EUVD-2026-89622

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript...

CVE-2026-92994 Verge3D < 4.13.1 - Unauthenticated Stored XSS via File Storage API

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript...

CVE-2026-92994 Verge3D < 4.13.1 - Unauthenticated Stored XSS via File Storage API

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript...

PT-2026-103043

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript...

CVE-2026-92994: Improper Neutralization of Input During Web Page Generation

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript...

OESA-2026-4069 git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: Processing an incomplete post-handshake message for a QUIC connection can cause a...

OESA-2026-4068 git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: Processing an incomplete post-handshake message for a QUIC connection can cause a...

OESA-2026-4067 git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: Processing an incomplete post-handshake message for a QUIC connection can cause a...

RLSA-2026:67161 Important: git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal...

ALSA-2026:66364 Important: git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal...

PT-2026-84306

A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type e.g., text/html for .html files, image/svg+xml for .svg files and without a Content-Disposition: attachment header when using local filesystem...