746946 matches found
Payload: Incomplete validation during the upload file lifecycle
Impact Under certain conditions, an authenticated user with permission to modify uploads could cause unintended files to be removed during file cleanup. This may result in data loss or service disruption. You are affected if: - You use Payload upload collections with local file storage. - Untrust...
EUVD-2026-93511
Payload: Incomplete validation during the upload file lifecycle...
GHSA-P223-2WR2-J562 Payload: Incomplete validation during the upload file lifecycle
Impact Under certain conditions, an authenticated user with permission to modify uploads could cause unintended files to be removed during file cleanup. This may result in data loss or service disruption. You are affected if: - You use Payload upload collections with local file storage. - Untrust...
GHSA-V5GF-VPJC-PC7W Payload: Unauthenticated account-lockout denial of service
Impact An unauthenticated attacker who knows an account’s email address or username could trigger Payload’s account lockout mechanism and prevent that user from signing in. You are affected if: Using an affected Payload version with an auth-enabled collection that uses local authentication and...
Payload: Unauthenticated account-lockout denial of service
Impact An unauthenticated attacker who knows an account’s email address or username could trigger Payload’s account lockout mechanism and prevent that user from signing in. You are affected if: Using an affected Payload version with an auth-enabled collection that uses local authentication and...
NPM: Payload: Unauthenticated account-lockout denial of service
NPM: Payload: Unauthenticated account-lockout denial of service vulnerability discovered by ? in WordPress Npm payload versions 3.90.0...
GHSA-7822-RCF6-97FX RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers
Summary A single AMQP message with malformed UTF-8 in a shortstr property for example correlation-id can permanently disable a Java client RPC consumer. The client decodes malformed bytes into U+FFFD replacement characters. Each of those re-encodes to 3 bytes, so a 255-byte property becomes 765...
Detection-and-Mitigation-script-for-CVE-2021-42717
Detection-and-Mitigation-script-for-CVE-2021-42717 CVE-2021-42717 の検出・緩和スクリプト - JSON パーシングにおける ModSecurity DoS 脆弱性 ModSecurity 3.x から 3.0.5 までは、過度にネストされた JSON オブジェクトを誤って処理します。何万もの深さでネストされた巧妙に細工された JSON オブジェクトは、Web サーバーが正当なリクエストを処理できなくなる可能性があります。中程度の大きさ（例: 300KB）の HTTP リクエストでも、限られた NGINX ワーカープロセスの...
EUVD-2026-93557
ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer...
EUVD-2026-93553
ImageSharp: ICC LUT16 output channel count can write beyond Vector4...
GHSA-WMXV-XPHR-5C9G ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop
Summary SixLabors.ImageSharp 4.1.1 can spend an attacker-controlled duration decoding a small malformed BigTIFF. The BigTIFF IFD entry-count field is 64-bit. The reader iterates once per declared entry, but when fewer than 20 bytes remain for an entry, the entry read returns without advancing. A...
GHSA-89VP-X45C-52CQ Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service
Summary A DOM Clobbering vulnerability exists in Quasar's openURL utility when handling the iOS SafariViewController bridge. The vulnerable implementation only checks whether window.SafariViewController exists before invoking it as a native bridge object. An attacker who can inject HTML content...
Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service
Summary A DOM Clobbering vulnerability exists in Quasar's openURL utility when handling the iOS SafariViewController bridge. The vulnerable implementation only checks whether window.SafariViewController exists before invoking it as a native bridge object. An attacker who can inject HTML content...
CVE-2026-97715
CVE-2026-97715 is a vulnerability in the client registration process of Secure Access servers prior to version 14.60. Authenticated attackers can pass malformed data to the server and cause a persistent denial of service...
CVE-2026-97717
CVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60. Authenticated attackers can send malformed data to the server and cause a persistent denial of service...
CVE-2026-97714
CVE-2026-97714 is a is a vulnerability in the authentication sub-system of Secure Access servers prior to version 14.60. Attackers can send a malformed response during authentication and cause a persistent denial of service...
HTTP3ONSTEROIDS
目次 脆弱性の説明 ソースコードレビュー ラボのセットアップ 問題の特定 参考文献 脆弱性の説明 HAProxyのHTTP/3実装は、不正なHTTPヘッダーフィールド名 をブロックできず、この不正なヘッダーを誤って処理するサーバーの前段にデプロイされた場合 、HTTPリクエスト/レスポンススマグリング攻撃に悪用される可能性があります。リモートの攻撃者は、正規ユーザーのリクエストを改ざんする可能性があります。その結果、攻撃者は機密情報を取得したり、サービス妨害（DoS）状態を引き起こしたりする可能性があります。 https://jvn.jp/en/jp/JVN38170084/...
WordPress-Long-Password-Denial-of-Service
WordPress 서비스 거부 CVE-2014-9016 면책 조항 이 스크립트의 내용은 오로지 윤리적인 방식으로만 사용되도록 의도되었습니다. 장비 소유자의 서면 허가 없이 이 스크립트를 사용하지 마십시오. 불법 행위를 수행할 경우, 체포되어 법이 허용하는 최대한의 범위까지 기소될 가능성이 높습니다. Primus27은 이 스크립트의 오용에 대해 어떠한 책임도 지지 않습니다. 이 스크립트는 개념 증명 용도로만 제공됩니다. 여기에 포함된 애플리케이션은 적절한 서면 승인을 받은 테스트 환경에서만 사용해야 합니다. 익스플로잇 긴 비밀번...
CVE-2024-38063-scanner
概要 このプロジェクトは、Shodanを使用した偵察とScapyを使用した悪意のあるIPv6パケットの作成・送信により、脆弱なWindowsシステムを特定し、CVE-2024-38063 を標的とした攻撃を実行するPythonスクリプトです。このツールは、脆弱なホストの検索、脆弱性の確認、そしてブルースクリーン（BSOD）を誘発するサービス拒否（DoS）攻撃の実行プロセスを自動化します。 CVE-2024-38063の解説 CVE-2024-38063...
Apache-Dubbo-CVE-2023-23638-exp
より包括的なDubbo脆弱性スキャンツールは私の別のプロジェクトを参照してください：https://github.com/YYHYlh/Dubbo-Scan Apache-Dubbo-CVE-2023-23638-exp Apache Dubbo CVE-2023-23638 脆弱性悪用の工学的実践であり、Dubbo 3.x のサービスディスカバリから脆弱性悪用およびエコーバックまでのプロセスをカバーしています。このツールは研究および学習目的のみで提供されており、各位の専門家からの議論や貴重な提案をお待ちしております。 ツール説明 本ツールはCVE-2023-23638のDubbo...