68 matches found
ChurchCRM Authentication Error Vulnerability
ChurchCRM is ChurchCRM open source an open source CRM system for churches. ChurchCRM 5.18.0 and earlier versions have an authentication error vulnerability that stems from a lack of authentication in the AuthMiddleware function in the API Endpoint component, which can be exploited by an attacker ...
EUVD-2014-0092
Malware in sbrugna...
EUVD-2013-0404
Malware in sbrugna...
EUVD-2014-0107
Malware in sbrugna...
EUVD-2025-7059
Malicious code in bioql PyPI...
EUVD-2025-9629
Malicious code in bioql PyPI...
EUVD-2024-3014
Malicious code in bioql PyPI...
EUVD-2024-2263
Malicious code in bioql PyPI...
EUVD-2025-11356
Malicious code in bioql PyPI...
EUVD-2025-6008
Malicious code in bioql PyPI...
CVE-2025-54123
Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulnerability at /api/v2/hoverfly/middleware endpoint due to insufficient validation and sanitization in user input. The vulnerability exists i...
CVE-2025-54123
Hoverfly (versions
Duplicate Advisory: Denial of service via malicious preflight requests in github.com/rs/cors
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mh55-gqvf-xfwm. This link is maintained to preserve external references. Original Description Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include ...
CVE-2025-47908
Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers ACRH header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt...
CVE-2025-47908
The github.com/rs/cors middleware is vulnerable to a denial of service (DoS) attack. An attacker can send malicious preflight requests containing an Access-Control-Request-Headers (ACRH) header with a large number of commas, triggering a prohibitive amount of heap allocations . This resource exha...
Authentication Bypass by Primary Weakness
Overview Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness via r.URL.Path function in the middleware process. An attacker can execute arbitrary system commands or gain control over managed hosts by accessing the backend login path without authentication...
CVE-2024-40627
Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. OpaMiddleware allows all HTTP OPTIONS requests without evaluating it against...
CVE-2023-50965
In MicroHttpServer aka Micro HTTP Server through 4398570, ReadStaticFiles in lib/middleware.c allows a stack-based buffer overflow and potentially remote code execution via a long URI...
Rack session gets restored after deletion
Summary When using the Rack::Session::Pool middleware, simultaneous rack requests can restore a deleted rack session, which allows the unauthenticated user to occupy that session. Details Rack session middleware prepares the session at the beginning of request, then saves is back to the store wit...
