CiclopeClic

CiclopeClic 인공지능 기반의 통제된 보안 인식 도구 CiclopeClic에 오신 것을 환영합니다! 🔐 보안 팀이 통제된 피싱 테스트를 수행하고, 사용자를 교육하며, 인공지능의 힘으로 디지털 자산 보호를 강화할 수 있는 안전하고 맞춤화된 링크를 생성하는 능력을 상상해보세요. 그것이 바로 CiclopeClic입니다! 💡 놀라운 기능들: 보안 링크 생성 : CiclopeClic을 사용하면 통제된 환경에서 피싱 공격을 시뮬레이션하는 데 완벽한 완전히 안전한 URL을 생성할 수 있습니다. 이를 통해 사용자 반응을 평가하고 디지...

PT-2026-91179

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Syncope. The notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline, via malicious HTTP link generation...

CVE-2026-78318: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Syncope. The notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline, via malicious HTTP link generation...

The vulnerability of the am33xx_pm_probe() function in the drivers/soc/ti/pm33xx.c file of the Linux operating system’s kernel driver module allows a hacker to cause a system failure.

The vulnerability of the am33xxpmprobe function in the drivers/soc/ti/pm33xx.c file of the Linux operating system’s kernel module is related to errors during link generation. Exploiting this vulnerability can allow an attacker to cause a system failure...

Host Header Injection

github.com/zitadel/zitadel is vulnerable to Host Header Injection. The vulnerability is due to improper validation of the Forwarded or X-Forwarded-Host headers when generating password reset links, which allows an attacker to manipulate the link to a malicious domain and capture the reset code,...

Rack::Request accepts invalid Host characters, enabling host allowlist bypass

Summary Rack::Request parses the Host header using an AUTHORITY regular expression that accepts characters not permitted in RFC-compliant hostnames, including /, ?, , and @. Because req.host returns the full parsed value, applications that validate hosts using naive prefix or suffix checks can be...

EUVD-2026-18478

Rack::Request accepts invalid Host characters, enabling host allowlist bypass...

The vulnerability of the ppr_notifier() function in the drivers/iommu/amd/iommu_v2.c file of the Linux operating system’s IOMMU driver allows a hacker to trigger a service failure.

The vulnerability of the pprnotifier function in the drivers/iommu/amd/iommuv2.c file of the Linux IOMMU driver module is related to errors during link generation. Exploiting this vulnerability could allow an attacker to cause a service failure...

GHSA-H7VR-CG25-JF8C StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation

Summary The POST /studiocmsapi/dashboard/create-reset-link endpoint allows any authenticated user with admin privileges to generate a password reset token for any other user, including the owner account. The handler verifies that the caller is an admin but does not enforce role hierarchy, nor doe...

CVE-2025-62516

Landlord Onboarding & Rental Signup introduces the landlord onboarding workflow and rental signup system for VivaTurbo Rentals & Property Services. In 2.0.0 and earlier, a vulnerability was identified in the TurboTenant property listing activation workflow that could allow unauthorized access to...

CVE-2025-62516

CVE-2025-62516 entry rejected; not an active vulnerability.

EUVD-2025-36366

Landlord Onboarding & Rental Signup introduces the landlord onboarding workflow and rental signup system for VivaTurbo Rentals & Property Services. In 2.0.0 and earlier, a vulnerability was identified in the TurboTenant property listing activation workflow that could allow unauthorized access to...

CVE-2025-62516 Landlord Onboarding & Rental Signup Unauthorized Access Vulnerability in TurboTenant Stripe Integration

Landlord Onboarding & Rental Signup introduces the landlord onboarding workflow and rental signup system for VivaTurbo Rentals & Property Services. In 2.0.0 and earlier, a vulnerability was identified in the TurboTenant property listing activation workflow that could allow unauthorized access to...

CVE-2025-31122 scratch-coding-hut.github.io Login Links Generation vulnerability

scratch-coding-hut.github.io is the website for Coding Hut. In 1.0-beta3 and earlier, the login link can be used to login to any account by changing the username in the username field...

GHSA-R57H-547H-W24F PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters

Product: PhpSpreadsheet Version: 3.8.0 CWE-ID: CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' CVSS vector v.3.1: 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS vector v.4.0: 4.8 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N Description: an attack...

BIT-GITLAB-2024-1493 Uncontrolled Resource Consumption in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 9.2 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, with the processing logic for generating link in dependency files can lead to a regular expression DoS attack on the serve...

UBUNTU-CVE-2024-1493

An issue was discovered in GitLab CE/EE affecting all versions starting from 9.2 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, with the processing logic for generating link in dependency files can lead to a regular expression DoS attack on the serve...

CVE-2024-1493

CVE-2024-1493 concerns GitLab CE/EE where the dependency-file link generation logic can trigger a regular-expression DoS on the server. Affected versions are: GitLab 9.2–16.11.4, 17.0.x before 17.0.3, and 17.1.x before 17.1.1. The issue is rooted in how dependency links are generated, leading to ...

CVE-2024-1493 Uncontrolled Resource Consumption in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 9.2 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, with the processing logic for generating link in dependency files can lead to a regular expression DoS attack on the serve...

PT-2024-2098 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2023.11.4 Description: The issue is related to improper authorization of presigned URL generation requests in the S3 Artifact Storage plugin. This could allow a remote attacker to bypass existing security...