2540 matches found
rack-mini-profiler - Environment Information Disclosure Detection
rack-mini-profiler is prone to environmental information disclosure which could help an attacker formulate additional attacks. !/usr/bin/env python3 -- coding: utf-8 -- """rack-mini-profiler is prone to environmental information disclosure which could help an attacker formulate add.""" from...
CVE-2026-47737 Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections
Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when setremoteaddress proxyprotocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive...
EUVD-2026-44427
Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when setremoteaddress proxyprotocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive...
CVE-2026-47736: Uncontrolled Resource Consumption
Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends...
Nautobot may allows uploaded media files to be accessible without authentication
ImpactFiles uploaded by users to Nautobot's MEDIAROOT directory, including DeviceType image attachments as well as images attached to a Location, Device, or Rack, are served to users via a URL endpoint that was not enforcing user authentication. As a consequence, such files can be retrieved by...
Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport
Summary An unauthenticated remote attacker can force any MCP Ruby SDK server using MCP::Server::Transports::StreamableHTTPTransport to allocate gigabytes of memory by sending a single oversized JSON-RPC POST. The transport reads the entire HTTP body into a Ruby String and parses it with...
Rust Rack Session DoS
The vulnerability of the Rust library for session management in Rack applications is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to cause service failures...
Rack Uncontrolled Resource Consumption DoS
The vulnerability of the modular interface between web servers and Rack web applications is related to uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures...
Rack Request Bypass
The vulnerability of the Rack::Request component in the Ruby-based Rack web server module interface is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to bypass existing security restrictions remotely...
Exploit for Improper Validation of Syntactic Correctness of Input in Rack
This repository provides a black-box security analysis of CVE-20...
FreeBSD : FreeBSD -- Use-after-free in TCP RACK stack option handler (6c547c1b-74e2-11f1-958d-bc241121aa0a)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 6c547c1b-74e2-11f1-958d-bc241121aa0a advisory. The RACK setsockopt2 handler drops the connection lock in order to copy option data from userspace, the...
Dell PowerFlex Manager Storage Data Compromise
The vulnerabilities of hardware and software solutions for data storage and information processing in Dell PowerFlex Manager, PowerFlex Appliance, and PowerFlex Rack involve insecure storage of confidential information. Exploiting these vulnerabilities can allow attackers to gain unauthorized...
Dell PowerFlex Manager Data Storage
The vulnerability of hardware and software solutions for data storage and information processing in Dell PowerFlex Manager, PowerFlex Appliance, and PowerFlex Rack is related to the improper use of standard permissions. Exploiting this vulnerability can allow attackers to disclose protected...
Dell PowerFlex Manager PowerFlex Appliance Rack Cryptographic Algorithm Security Bypass
The vulnerabilities of hardware and software solutions for data storage and information processing in Dell PowerFlex Manager, PowerFlex Appliance, and PowerFlex Rack are related to the use of cryptographic algorithms that contain vulnerabilities. Exploiting these vulnerabilities can allow attacke...
Dell PowerFlex Manager Authentication Bypass
The vulnerabilities of hardware and software solutions for data storage and information processing in Dell PowerFlex Manager, PowerFlex Appliance, and PowerFlex Rack are related to errors in the authentication process. Exploiting these vulnerabilities can allow unauthorized actors to compromise t...
Dell PowerFlex Manager Privilege Escalation
The vulnerability of hardware and software solutions for data storage and information processing in Dell PowerFlex Manager, PowerFlex Appliance, and PowerFlex Rack is related to improper privilege assignment. Exploiting this vulnerability can allow attackers to enhance their privileges...
Dell PowerFlex Manager URL Redirection Phishing
The vulnerability of hardware and software solutions for data storage and information processing in Dell PowerFlex Manager, PowerFlex Appliance, and PowerFlex Rack lies in the redirection of URLs to an unreliable website. Exploiting this vulnerability allows a remote attacker to carry out phishin...
Dell PowerFlex Manager Information Disclosure
The vulnerabilities of hardware and software solutions for data storage and information processing in Dell PowerFlex Manager, PowerFlex Appliance, and PowerFlex Rack involve insecure storage of confidential information. Exploiting these vulnerabilities can allow attackers to gain unauthorized...
FreeBSD Security Advisory - FreeBSD-SA-26:43.tcp
FreeBSD Security Advisory - The RACK setsockopt2 handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection...
FreeBSD -- Use-after-free in TCP RACK stack option handler
Problem Description: The RACK setsockopt2 handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control...