Directory Traversal

Overview github.com/traefik/traefik/v2/pkg/server is a server package for traefik, a cloud native edge router. Affected versions of this package are vulnerable to Directory Traversal when routing requests to a backend using a PathPrefix, Path, or PathRegex matcher. An attacker can bypass the...

CVE-2025-32431 Traefik has a possible vulnerability with the path matchers

Traefik pronounced traffic is an HTTP reverse proxy and load balancer. In versions prior to 2.11.24, 3.3.6, and 3.4.0-rc2. There is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher. When Traefik is configured to route the requests to a backe...

Traefik 路径遍历漏洞

Traefik is an open source reverse proxy and load balancing tool from Traefik Open Source. Traefik suffers from a path traversal vulnerability that stems from the fact that when managing requests using a PathPrefix, Path, or PathRegex matcher, it is possible to bypass the middleware chain by using...

PT-2025-17448 · Traefik · Traefik

Name of the Vulnerable Software and Affected Versions: Traefik versions prior to 2.11.24 Traefik versions prior to 3.3.6 Traefik versions prior to 3.4.0-rc2 Description: The issue concerns Traefik, an HTTP reverse proxy and load balancer, where a potential vulnerability exists in managing request...

CVE-2025-32779

E.D.D.I Enhanced Dialog Driven Interface is a middleware to connect and manage LLM API bots. In versions before 5.5.0, an attacker with access to the /backup/import API endpoint can write arbitrary files to locations outside the intended extraction directory due to a Zip Slip vulnerability...

Malicious code in eigenlayer-middleware (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7dcbc6398c70af4eea7bcb6879aced4ed322d24aa860eff099e1054163764f2c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3237 Malicious code in eigenlayer-middleware (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7dcbc6398c70af4eea7bcb6879aced4ed322d24aa860eff099e1054163764f2c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Oracle WebLogic Server (April 2025 CPU)

The 12.2.1.4.0 and 14.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by a vulnerability as referenced in the April 2025 CPU advisory. - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Centralized Thirdparty Jars Apache...

Vulnerabilities fixed in Oracle Fusion Middleware

Oracle has fixed multiple vulnerabilities in several products, including the Utilities Application Framework, WebLogic Server, and Fusion Middleware. The vulnerabilities allow unauthenticated malicious actors to gain access to critical data, cause denial-of-service DoS, and in some cases even gai...

Exploit for CVE-2025-29927

CVE-2025-29927 - Next.js Middleware Authorization Bypass PoC...

Important: Red Hat Security Advisory: ACS 4.5 enhancement and security update

Updated images are now available for Red Hat Advanced Cluster Security RHACS. This release of RHACS includes the following bug fix: Fixed a bug to match the aggregation field of the compliance tables to the widgets for consistency. This release also addresses the following security vulnerabilitie...

CVE-2025-24358 gorilla/csrf CSRF vulnerability due to broken Referer validation

gorilla/csrf provides Cross Site Request Forgery CSRF prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes...

CVE-2025-32779

E.D.D.I Enhanced Dialog Driven Interface is a middleware to connect and manage LLM API bots. In versions before 5.5.0, an attacker with access to the /backup/import API endpoint can write arbitrary files to locations outside the intended extraction directory due to a Zip Slip vulnerability...

CVE-2025-32779 labsai/eddi Vulnerable to Path Traversal (Zip Slip) in ZIP Import Function

E.D.D.I Enhanced Dialog Driven Interface is a middleware to connect and manage LLM API bots. In versions before 5.5.0, an attacker with access to the /backup/import API endpoint can write arbitrary files to locations outside the intended extraction directory due to a Zip Slip vulnerability...

Always-Incorrect Control Flow Implementation

Overview Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation in the fixRequestBody function. An attacker can cause writeBody to be called multiple times, leading to unexpected behavior. Remediation A fix was pushed into the master branch but not yet...

0xrtest (1.0.0), 7qb-cli (0.0.16) +2776 more potentially affected by CVE-2025-32996 via http-proxy-middleware (>=1.3.0, <=2.0.7)

http-proxy-middleware NPM version =1.3.0, =0.0.11, =0.0.6, =1.1.40, =0.1.10, =0.2.14, =1.6.0, =1.7.0, =0.0.39, =7.0.0, =8.3.0 and more Source cves: CVE-2025-32996 Source advisory: OSV:GHSA-4WWW-5P9H-95MH...

http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed...

@amazeelabs/publisher (>=2.4.28, <=3.2.6), @angular-devkit/build-angular (>=18.0.0-next.3, <=20.0.0-next.5) +87 more potentially affected by CVE-2025-32997 via http-proxy-middleware (>=3.0.0, <=3.0.3)

http-proxy-middleware NPM version =3.0.0, =2.4.28, =18.0.0-next.3, =1.0.0, =18.0.0-next.39, =18.0.0-next.39, =2.1.0-next.0, =2.1.0-next.0, =2.1.0-next.0, =2.1.0-next.0, =2.1.0-next.0, =8.10.0-nightly.20240906232837, =9.0.0, =9.0.0, =9.0.0, =3.11.0-beta.6, =3.26.12 and more Source cves:...

http-proxy-middleware can call writeBody twice because "else if" is not used

In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used...

@amazeelabs/publisher (>=2.4.28, <=3.2.6), @angular-devkit/build-angular (>=18.0.0-next.3, <=20.0.0-next.5) +87 more potentially affected by CVE-2025-32996 via http-proxy-middleware (>=3.0.0, <=3.0.3)

http-proxy-middleware NPM version =3.0.0, =2.4.28, =18.0.0-next.3, =1.0.0, =18.0.0-next.39, =18.0.0-next.39, =2.1.0-next.0, =2.1.0-next.0, =2.1.0-next.0, =2.1.0-next.0, =2.1.0-next.0, =8.10.0-nightly.20240906232837, =9.0.0, =9.0.0, =9.0.0, =3.11.0-beta.6, =3.26.12 and more Source cves:...