91 matches found
CVE-2019-16278
CVE-2019-16278 - Nostromo nhttpd 원격 코드 실행RCE 취약점 설명 HTTP 요청 처리 과정의 디렉터리 경로 탐색directory traversal을 통해 Nostromo nhttpd 1.9.6 이하 버전에서 발생하는 원격 코드 실행RCE 취약점입니다. 영향을 받는 버전 Nostromo nhttpd 1.9.6 및 이전 버전 익스플로잇 상세 이 익스플로잇은 URL 인코딩된 CRLF 문자%0d를 사용한 디렉터리 경로 탐색 취약점을 악용하여 /bin/sh에 접근하고 임의의 명령을 실행합니다. 작동 방식: 1...
CVE-2026-84645
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins such as the global configuration and jobs can appear as nested field values in user-submitted config.xml documents and subsequently...
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge web browsers allows attackers to induce a service failure.
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge web browsers allows a perpetrator to trigger a service failure.
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...
The vulnerability of the DevTools component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.
The vulnerability of the DevTools component in Google Chrome and Microsoft Edge is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...
The vulnerability of the Skia component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.
The vulnerability of the Skia component in Google Chrome and Microsoft Edge is related to errors in HTTP request processing. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...
The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.
The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data through a specially created HTML page...
0xtrails (>=0.0.0-canary-3a59770274bcb6f3bebd5d1b93a2c92d1fc4edbd, <=0.18.4), 123pancli (1.0.0) +6602 more potentially affected by CVE-2026-67315 via axios (>=1.15.0, <=1.17.0)
axios NPM version =1.15.0, =0.0.0-canary-3a59770274bcb6f3bebd5d1b93a2c92d1fc4edbd, =0.1.0, =1.1.0, =0.1.0, =1.0.21, =0.1.4, =0.1.0, =1.0.10, =1.0.10, =0.6.6, =0.6.10, =0.6.9, =0.0.1, =0.0.7 - @0xfps/voidcli 0.0.1 and more Source cves: CVE-2026-67315 Source advisory: OSV:GHSA-F4GW-2P7V-4548...
GHSA-G2XQ-2V27-4RH3 Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation
In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled config.xml submission in a way that allows them to handle HTTP requests afterwards. This can be used to...
PT-2026-40607
Name of the Vulnerable Software and Affected Versions bandit versions 1.4.0 through 1.11.0 Description An unauthenticated remote attacker can cause a denial of service via memory exhaustion. The read data/2 function in Elixir.Bandit.HTTP1.Socket ignores the :length option when processing HTTP/1...
-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +16000 more potentially affected by CVE-2026-42038 via axios (>=1.0.0, <=1.15.0)
axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-42038 Source advisory: SNYK:JS-AXIOS-16298095...
PT-2026-29619
IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 IBM Security Verify could allow a remote attacker to access sensitive...
AZL-81239 CVE-2026-21710 affecting package nodejs for versions less than 20.14.0-15
A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a header named proto and the application accesses req.headersDistinct. When this occurs, dest"proto" resolves to Object.prototype rather than undefined, causing .push to be called on a non-array...
dotnet: .NET Security Feature Bypass Vulnerability
A flaw was found in ASP.NET Core’s HTTP request handling that leads to inconsistent interpretation of specially crafted HTTP requests. This mismatch can be abused by an authorized network attacker to smuggle or manipulate request boundaries, allowing bypass of security controls or unintended...
EUVD-2017-15964
Malware in sbrugna...
EUVD-2014-0451
Malware in sbrugna...
EUVD-2014-0464
Malware in sbrugna...
EUVD-2024-41622
Malicious code in bioql PyPI...