66 matches found
CVE-2026-75628
Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because sameoriginpath accepts a backslash or tab in the return parameter. oauth2login reads the return parameter from the initiation request, runs sameoriginpath over it, and stores the survivor in...
EUVD-2026-63189
Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because sameoriginpath accepts a backslash or tab in the return parameter. oauth2login reads the return parameter from the initiation request, runs sameoriginpath over it, and stores the survivor in...
CVE-2026-75628 Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the return parameter
Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because sameoriginpath accepts a backslash or tab in the return parameter. oauth2login reads the return parameter from the initiation request, runs sameoriginpath over it, and stores the survivor in...
CVE-2026-75628 Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the return parameter
Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because sameoriginpath accepts a backslash or tab in the return parameter. oauth2login reads the return parameter from the initiation request, runs sameoriginpath over it, and stores the survivor in...
CVE-2026-75628
The Punk::OAuth2 Perl module (versions before 0.03 ) is vulnerable to an unauthorized off-site redirect following authentication. The root cause lies in the same_origin_path function, which fails to reject backslashes or tabs in the return parameter of the oauth2_login initiation request. Because...
CVE-2026-75628: URL Redirection to Untrusted Site
Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because sameoriginpath accepts a backslash or tab in the return parameter. oauth2login reads the return parameter from the initiation request, runs sameoriginpath over it, and stores the survivor in...
PT-2026-78875
Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same origin path accepts a backslash or tab in the return parameter. oauth2 login reads the return parameter from the initiation request, runs same origin path over it, and stores the survivo...
roc-punk (>=0.2.3, <=0.2.9) potentially affected by CVE-2026-49452 via weasyprint (0.28.0)
weasyprint PYPI version 0.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - roc-punk =0.2.3, =0.2.9 Source cves: CVE-2026-49452 Source advisory: OSV:PYSEC-2026-3412...
roc-punk (>=0.2.3, <=0.2.9) potentially affected by CVE-2025-68616 via weasyprint (0.28.0)
weasyprint PYPI version 0.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - roc-punk =0.2.3, =0.2.9 Source cves: CVE-2025-68616 Source advisory: OSV:PYSEC-2026-2034...
roc-punk (>=0.2.3, <=0.2.9) potentially affected by CVE-2026-49452 via weasyprint (0.28.0)
weasyprint PYPI version 0.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - roc-punk =0.2.3, =0.2.9 Source cves: CVE-2026-49452 Source advisory: OSV:GHSA-JHHC-3HCP-QHM5...
roc-punk (>=0.2.3, <=0.2.9) potentially affected by CVE-2025-68616 via weasyprint (0.28.0)
weasyprint PYPI version 0.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - roc-punk =0.2.3, =0.2.9 Source cves: CVE-2025-68616 Source advisory: OSV:GHSA-983W-RHVV-GWMV...
CISA and Partners Release Advisory Update on Akira Ransomware
Today, Cybersecurity and Infrastructure Security Agency CISA, in collaboration with the Federal Bureau of Investigation, Department of Defense Cyber Crime Center, Department of Health and Human Services, and international partners, released an updated joint Cybersecurity Advisory, StopRansomware:...
Friday Squid Blogging: Two-Man Giant Squid
The Brooklyn indie art-punk group, Two-Man Giant Squid, just released a new album. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered...
MAL-2024-2229 Malicious code in down_load_epub_bindle_punk_bruja_q4lej5 (npm)
--- -= Per source details. Do not edit below this line.=-...
punk-gothic-shop.de Cross Site Scripting vulnerability OBB-3878388
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
IBM: jazz.net - publicly accessible .svn repositories
The vulnerability regarding publicly accessible .svn/entries files in jazz.net was reported to IBM, analyzed, and remediated. The issue was identified by an external researcher...
punk-gothic-shop.de Cross Site Scripting vulnerability OBB-3507833
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
punk-shop.com Cross Site Scripting vulnerability OBB-3451284
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
PUNK does not conform to ERC721 standard hence safeTransferFrom from solmate does not work
Lines of code Vulnerability details Impact Since protocol's intended NFT target is PUNK currently, the protocol will be hugely affected. Proof of Concept Attempts to transfer the NFT is done in 2 places. 1. removeCollateral 2. purchaseNFT Firstly, this means that once a collateral is added to the...
punk-shop.com Cross Site Scripting vulnerability OBB-2822742
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...