CVE-2026-106512 MISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS

The CakeResponse::download method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the unpatched code. First, if the filename...

CVE-2026-106512 MISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS

The CakeResponse::download method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the unpatched code. First, if the filename...

Security Bulletin: IBM SPSS Modeler is affected by vulnerabilities in Eclipse Jetty

Summary IBM SPSS Modeler is affected by vulnerabilities in Eclipse Jetty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-6790 DESCRIPTION: In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host a...

CVE-2026-23918-poc

CVE-2026-23918 — التحرير المزدوج في Apache modhttp2 المتأثر: خادم Apache HTTP 2.4.66 مع modhttp2 + Event MPM تم الإصلاح في: Apache 2.4.67 modh2 v2.0.37 CVSS 3.1: 8.8 عالي — تنفيذ تعليمات برمجية عن بُعد غير مصادق عليه ممكن CWE: CWE-415 تحرير مزدوج ما هي الثغرة يحتوي modhttp2 في Apache 2.4.66 على...

CVE-2023-46604-RCE

CVE-2023-46604-RCE Implémentation Python de l'exécution de code à distance non authentifiée Apache ActiveMQ Configuration et exploitation nc -lvnp 4444 - Démarrer le listener python3 -m http.server 8080 - Héberger poc.xml contenant votre charge utile python3 CVE-2023-46604-RCE.py -i -p -u...

CVE-2019-16724

Description de vulnérabilité File Sharing Wizard 1.5.0 permet à un attaquant distant d'obtenir une exécution de code arbitraire en exploitant un débordement de tampon basé sur Structured Exception Handler SEH dans un paramètre HTTP POST. Cet exploit a été testé sur Windows 7 Home. Il échouera trè...

ASUS-AiCloud-RCE

Origasus origasus.go ile derlenen, ASUS AiCloud / AsusWRT ile ilişkilendirilebilecek uçların yetkili güvenlik testi veya savunma analizi ör. kendi cihazınız, yazılı penetest laboratuvarı kapsamında incelenmesi için yazılmış bir Go programıdır. هام: استخدام مثل هذه البرامج ضد أنظمة غير مصرح بها هو...

CVE-2026-49975

CVE-2026-49975 قنبلة HTTP/2 ★ CVE-2026-49975 إثبات المفهوم لقنبلة HTTP/2 ★ نظرة عامة CVE-2026-49975 هو ثغرة حرمان من الخدمة DoS في خادم Apache HTTP. تحدث الثغرة في مسار معالجة طلبات HTTP/2، حيث يمكن دمج حقول cookie المتعددة دون أن تُحتسب بشكل صحيح ضمن LimitRequestFields. من خلال إرسال طلب HTTP/2...

CVE-2026-83550 Postgres-exporter: net/http/pprof exposed on metrics listener

A flaw was found in postgres-exporter. Due to the blank import of net/http/pprof, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process...

CVE-2026-83550

A flaw in postgres-exporter exposes debug endpoints on the unauthenticated metrics listener due to a blank import of net/http/pprof . A remote attacker within the cluster network can access these endpoints to perform information disclosure , potentially uncovering process arguments, goroutine sta...

CVE-2026-83550 Postgres-exporter: net/http/pprof exposed on metrics listener

A flaw was found in postgres-exporter. Due to the blank import of net/http/pprof, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process...

CVE-2026-83550

A flaw was found in postgres-exporter. Due to the blank import of net/http/pprof, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process...

CVE-2026-84429

A flaw was found in Django. Inefficient processing occurs when the HTTP header parsing function handles quoted parameter values containing numerous separator characters. A remote, unauthenticated attacker could exploit this flaw by sending requests with crafted header parameters, causing excessiv...

CVE-2019-0211-exploit

CVE-2019-0211 — تصعيد محلي للامتيازات في Apache HTTP Server CARPE DIEM الوصف CVE-2019-0211 هي ثغرة تصعيد امتيازات محلي تؤثر على Apache HTTP Server بين الإصدارين 2.4.17 و2.4.38 مع modprefork وmodphp أو PHP-FPM. تتيح هذه الثغرة لمهاجم يملك شل shell بصلاحيات www-data تصعيد الصلاحيات إلى root عبر مزي...

CVE-2018-5354

CVE-2018-5354 رفع الامتيازات/تنفيذ التعليمات البرمجية عن بُعد في عميل إعادة تعيين كلمة المرور ANIXIS معلومات البائع: ANIXIS المنتج: عميل إعادة تعيين كلمة المرور ANIXIS الإصدارات المتأثرة: قبل الإصدار 3.22 الباحث: Jason Juntunen المعروف باسم @missing0x00 https://github.com/missing0x00 CVSS: 8.8...

sickrageWTF

Sickrage : identifiants GitHub en clair CVE-2018-9160 1. À propos Exploit Title: SickRage Identifiants en clair dans la réponse HTTP Date: 2018-04-01 Exploit Author: Sven Fassbender Contact: https://twitter.com/mezdanak Vendor Homepage: https://sickrage.github.io Software Link:...

CVE-2019-10092

CVE-2019-10092: Cross-Site Scripting limité via la page « Erreur du proxy » dans Apache HTTP Server Dans Apache HTTP Server 2.4.0-2.4.39, un problème limité de cross-site scripting a été signalé affectant la page d'erreur modproxy. Un attaquant pouvait provoquer une malformation du lien sur la pa...

USN-8890-1: libsoup vulnerabilities

It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. CVE-2026-4271 It was discovered that libsoup incorrectly handled certain HTTPS...

CVE-2025-31324

CVE-2025-31324 Comment fonctionne cette méthode de détection ? Le modèle effectue une requête HTTP GET sur l'URL de base de la cible et examine les en-têtes de réponse pour identifier les instances de SAP NetWeaver Application Server. Ces informations aident à évaluer si le système pourrait être...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...