CVE-2024-25503

CVE-2024-25503 취약점 유형 : Cross Site Scripting XSS 제품: Advanced REST Client 데스크톱 애플리케이션 취약한 버전: 17.0.9 제품 공급업체:https://www.advancedrestclient.com/ 1. 설명 Advanced REST Client v.17.0.9의 XSSCross-Site Scripting 취약점으로 인해 원격 공격자가 임의 코드를 실행하고 민감한 정보를 얻을 수 있습니다. 이는 New Project 함수의 'edit details' 매개변수 내에서...

inspec_cve_2019_15224

악성 rest-client gem 2019년 8월 19일, rest-client gem에 악성 코드를 포함한 여러 버전이 게시된 것이 발견되었습니다. 악성 rest-client를 발견하는 과정에서, 몇몇 다른 새로운 gem들도 유사한 코드를 포함하고 있는 것으로 확인되었습니다. 관련 보도: https://www.securityweek.com/backdoor-found-rest-client-ruby-gem https://www.theregister.co.uk/2019/08/20/rubygemhacked/...

WiFi-Pineapple-MK7_REST-Client

WIFI PINEAPPLE MARK VII - REST 클라이언트 근접 작전을 위한 선도적인 rogue 액세스 포인트 및 WiFi 침투 테스트 툴킷입니다. 수동 및 능동 공격은 취약하고 잘못 구성된 장치를 분석합니다. https://hak5.org/collections/sale/products/wifi-pineapple 저자 :: TW-D 버전 :: 1.3.7 저작권 :: Copyright c 2024 TW-D 라이선스 :: Ruby와 동일한 조건으로 배포됩니다. 문서 ::...

CVE-2026-46453

camel-elasticsearch-rest-client 프리픽스 없는 헤더 인젝션 재현기 CVE-2026-46453 이 프로젝트는 Apache Camel의 camel-elasticsearch-rest-client 컴포넌트에서 메시지 헤더 인젝션 / 인가 우회 를 시연하며, CVE-2026-46453 로 추적됩니다. 이 컴포넌트는 동작을 제어하기 위해 여러 Exchange 헤더를 읽습니다 — SEARCHQUERY, OPERATION, INDEXNAME, INDEXSETTINGS, ID. 영향받는 버전에서 이 헤더들의 문자열 값...

The vulnerability of the camel-elasticsearch-rest-client component of the Java framework Apache Camel, which allows attackers to bypass existing security mechanisms

The vulnerability of the camel-elasticsearch-rest-client component of the Java framework Apache Camel is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to bypass existing security mechanisms remotely...

CVE-2026-46453

A flaw was found in the camel-elasticsearch-rest-client component of Apache Camel. An untrusted HTTP client can exploit this vulnerability by sending specific, unprefixed Exchange headers directly on its request when a Camel route exposes an HTTP entry point. This improper input validation allows...

MAL-2026-12744 Malicious code in devplatform-rest-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5813e9b97274c2eb3abd3459781550762baeea8c8fc0cec09603dac56a405d8 On require'devplatform-rest-client', index.js loads init.js which selects a platform-specific endpoint, downloads a binary from one of three Cloudfla...

Improper Handling of URL Encoding (Hex Encoding)

Overview Affected versions of this package are vulnerable to Improper Handling of URL Encoding Hex Encoding in the MCP REST client due to improper encoding of user-supplied identifiers during f-string URL construction. An attacker can access unintended API endpoints by injecting crafted path...

CVE-2026-41041 Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue...

CVE-2026-41041 Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue...

CVE-2026-41041 Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the ElasticSearchRestClientConstant header names and ElasticsearchRestClientEndpointBuilderFactory producer headers. An attacker can override the Elasticsearch query, operation, index...

GHSA-RP9M-HFV5-PFVR Apache Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel ElasticSearch Rest Client. The camel-elasticsearch-rest-client component reads several Exchange headers to control its behaviour - SEARCHQUERY an advanced query body, OPERATION which...

Apache Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel ElasticSearch Rest Client. The camel-elasticsearch-rest-client component reads several Exchange headers to control its behaviour - SEARCHQUERY an advanced query body, OPERATION which...

EUVD-2026-41827

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel ElasticSearch Rest Client. The camel-elasticsearch-rest-client component reads several Exchange headers to control its behaviour - SEARCHQUERY an advanced query body, OPERATION which...

CVE-2026-46453 Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel ElasticSearch Rest Client. The camel-elasticsearch-rest-client component reads several Exchange headers to control its behaviour - SEARCHQUERY an advanced query body, OPERATION which...

CVE-2026-46453 Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel ElasticSearch Rest Client. The camel-elasticsearch-rest-client component reads several Exchange headers to control its behaviour - SEARCHQUERY an advanced query body, OPERATION which...

CVE-2026-46453 Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel ElasticSearch Rest Client. The camel-elasticsearch-rest-client component reads several Exchange headers to control its behaviour - SEARCHQUERY an advanced query body, OPERATION which...

PT-2026-55888

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.3.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description Improper input validation in the camel-elasticsearch-rest-client component allows for authorization...

CVE-2026-46453: Improper Input Validation

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel ElasticSearch Rest Client. The camel-elasticsearch-rest-client component reads several Exchange headers to control its behaviour - SEARCHQUERY an advanced query body, OPERATION which...