Blind-SSRF-CVE-2020-15002

Sommario La logica in AddFileAction.getImageDataFromUrl per il recupero di immagini da URL esterni durante la gestione di /appsuite/api/oxodocumentfilter&action=addfile, implementata qui, valida gli URL reindirizzati solo dopo aver seguito tutti i redirect root@kitploit: response =...

github.com/getkin/kin-openapi: kin-openapi: kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

A flaw was found in kin-openapi. This vulnerability allows a remote attacker to bypass authentication checks. Specifically, the system incorrectly handles missing authentication configurations, substituting them with a function that does not verify user credentials. This enables unauthorized acce...

CVE-2024-6387

Dieses Repository hat keine README-Datei...

CVE-2019-3778-Spring-Security-OAuth-2.3-Open-Redirection

CVE-2019-3778-Spring-Security-OAuth-2.3-Open-Redirection Spring Security OAuth 2.3 Open Redirection - Analisi e Riproduzione Exploit Title: Redirect aperto in spring-security-oauth2 Date: 17 June 2019 Exploit Author: Riemann Vendor Homepage: https://spring.io/projects/spring-security-oauth Softwa...

CVE-2026-56782-Gorse-Auth-Bypass

CVE-2026-56782 — Gorse: Dump/Ripristino del Database non Autenticato Bypass Autenticazione Gorse 0.5.10 viene fornito con adminapikey = "". Gli endpoint HTTP master /api/dump e /api/restore sono protetti da un controllo admin che si apre in fallback quando nessuna chiave è configurata — il...

CVE-2019-14223

CVE-2019-14223: Open Redirect in Alfresco Share L'applicazione Alfresco Share è vulnerabile a un attacco Open Redirect tramite una richiesta POST appositamente predisposta. Manipolando il parametro “failure”, un attaccante può reindirizzare una vittima verso un sito web dannoso tramite qualsiasi...

CVE-2025-64495-POC

CVE-2025-64495-POC Open WebUI معرض لـ DOM XSS المخزنة عبر المطالبات عند تمكين 'إدراج المطالبة كنص منسق' مما يؤدي إلى ATO/RCE الملخص الوظيفة التي تُدرج المطالبات المخصصة في نافذة المحادثة معرضة لـ DOM XSS عند تمكين 'إدراج المطالبة كنص منسق'، حيث يتم تعيين نص المطالبة إلى موصل DOM .innerHtml دون...

asf__cxf_CVE-2019-17573_3-2-11

Bem-vindo ao Apache CXF! O Apache CXF é um framework de serviços de código aberto. O CXF ajuda você a construir e desenvolver serviços usando APIs de programação frontend, como JAX-WS e JAX-RS. Esses serviços podem falar uma variedade de protocolos, como SOAP, XML/HTTP, HTTP RESTful ou CORBA, e...

CVE-2023-34830---Reflected-XSS-found-in-I-doit-Open-v24-and-below

CVE-2023-34830 - XSS riflesso trovato in i-doit Open v24 e versioni precedenti i-doit Open v24 e versioni precedenti sono vulnerabili a una vulnerabilità di XSS riflesso. Queste vulnerabilità potrebbero consentire a utenti remoti autenticati di iniettare script web o HTML arbitrari. Descrizione d...

omigod-lab

Readme Una VM di laboratorio educativa per apprendere la vulnerabilità di esecuzione remota di codice RCE non autenticata con punteggio CVSS 9.6 nel software Open Management Infrastructure CVE-2021-38647. Divulgazione ricerca originale:...

cve-2026-71362-magento-lab

CVE-2026-71362 — Lab sul cambio di identità della sessione cliente di Magento / Adobe Commerce Un lab Docker autonomo, avviabile con un solo comando, che riproduce CVE-2026-71362 dall'inizio alla fine e consente di verificare la correzione di Adobe, così che difensori, ricercatori e studenti...

CVE-2024-7808

CVE-2024-7808 💀 $$\colorred THIS \space EXPLOIT \space MAY \space VIOLATE \space THE \space LAW.$$ $$\colorred\space YOU \space ARE \space RESPONSIBLE \space FOR \space YOUR \space ACTIONS.$$ $$\colorredDEMONSTRATION \space PURPOSE \space ONLY.$$ BESCHREIBUNG RCE durch Nicht-Admin-Benutzer via CS...

Ruby on Rails - Open Redirect via Host Header Injection

Ruby on Rails action pack before 6.1.2.1, 6.0.3.5 contains an open redirect caused by special crafted Host headers in combination with allowed host formats, letting attackers redirect users to malicious websites, exploit requires attacker to control Host headers. id: CVE-2021-22881 info: name: Ru...

Gitea <1.16.5 - Open Redirect

Gitea before 1.16.5 is susceptible to open redirect via GitHub repository go-gitea/gitea. An attacker can redirect a user to a malicious site and potentially obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2022-1058 info: name: Gitea 1.16.5 - Open Redire...

Apache Tomcat - Open Redirect

Apache Tomcat versions prior to 9.0.12, 8.5.34, and 7.0.91 are prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input. id: CVE-2018-11784 info: name: Apache Tomcat - Open Redirect author: geeknik severity: medium description: | Apache Tomcat versions...

Apache HTTP server v2.4.0 to v2.4.39 - Open Redirect

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with modrewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL. id: CVE-2019-10098 info: name: Apache HTTP server v2.4.0 to v2.4.39 - Open...

Node.JS System Information Library <5.3.1 - Remote Command Injection

Node.JS System Information Library System before version 5.3.1 is susceptible to remote command injection. Node.JS npm package "systeminformation" is an open source collection of functions to retrieve detailed hardware, system and OS information. id: CVE-2021-21315 info: name: Node.JS System...

Apache Struts - Multiple Open Redirection Vulnerabilities

Apache Struts is prone to multiple open-redirection vulnerabilities because the application fails to properly sanitize user-supplied input. id: CVE-2013-2248 info: name: Apache Struts - Multiple Open Redirection Vulnerabilities author: 0xAkoko severity: medium description: Apache Struts is prone ...

Microsoft OWA Exchange Server 2003 - 'redir.asp' Open Redirection

Open redirect vulnerability in exchweb/bin/redir.asp in Microsoft Outlook Web Access OWA for Exchange Server 2003 SP2 aka build 6.5.7638 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the URL parameter. id: CVE-2008-1547 info: name:...

Gitea <= 1.27.0 - Pre-Auth Remote Code Execution

Gitea versions 1.17 through 1.27.0 contain a remote code execution vulnerability in the diffpatch endpoint caused by an add/add collision that writes an executable Git hook into the bare repository's GITDIR. An attacker with write access can execute arbitrary commands as the Gitea service account...