route-detect

route-detect Webアプリケーションのルートにおける認証（authn）と認可（authz）のセキュリティバグを見つけます： koel ストリーミングサーバーからのルート WebアプリケーションのHTTPルートにおけるauthnおよびauthzのバグは、今日見られる最も一般的なセキュリティ問題の一部です。以下の業界標準のリソースは、その問題の深刻さを強調しています： 2021 OWASP Top 10 1 - アクセス制御の不備 2021 OWASP Top 10 7 - 識別と認証の失敗 2023 OWASP API Top 10 1 - オブジェクトレベルの認可の不備 20...

PT-2026-56012

Name of the Vulnerable Software and Affected Versions Traefik versions 3.7.0 through 3.7.5 Description Traefik's Kubernetes Gateway API provider may incorrectly resolve two accepted HTTPRoutes that target the same backend Service:port but use different backendRef filters for the same child servic...

PT-2026-26412

Summary Gateway auth for plugin channel endpoints can be bypassed when path canonicalization differs between the gateway guard and plugin handler routing. Details On affected versions, server-http only applies gateway auth when raw requestPath matches exactly: - /api/channels - /api/channels/ If ...

CVE-2024-8456 PLANET Technology switch devices - Missing Authentication for multiple HTTP routes

Certain switch models from PLANET Technology lack proper access control in firmware upload and download functionality, allowing unauthenticated remote attackers to download and upload firmware and system configurations, ultimately gaining full control of the devices...

CVE-2024-8456 PLANET Technology switch devices - Missing Authentication for multiple HTTP routes

Certain switch models from PLANET Technology lack proper access control in firmware upload and download functionality, allowing unauthenticated remote attackers to download and upload firmware and system configurations, ultimately gaining full control of the devices...

Gateway API route matching order contradicts specification

Impact Gateway API HTTPRoutes and GRPCRoutes do not follow the match precedence specified in the Gateway API specification. In particular, request headers are matched before request methods, when the specification describes that the request methods must be respected before headers are matched...

Default swagger-ui configuration exposes all files in the module

Impact The default configuration of @fastify/swagger-ui without baseDir set will lead to all files in the module's directory being exposed via http routes served by the module. Patches Update to v2.1.0 Workarounds Use the baseDir option References HackerOne report...