IBM DataPower Gateway 跨站请求伪造漏洞

IBM DataPower Gateway is an enterprise-grade application security gateway that provides API management and traffic control capabilities. A cross-site request forgery vulnerability exists in IBM DataPower Gateway. The vulnerability arises because the system fails to effectively validate the source...

Dell PowerProtect Data Manager 安全漏洞

Dell PowerProtect Data Manager PPDM is a data protection solution developed by the American company Dell. This product supports functions such as data backup, virtual machine backup, and database protection. Versions of Dell PowerProtect Data Manager prior to 19.22 contained a security...

Arbitrary File Read via Prompt Tag Source Validation Bypass in CreateModelVersion

The createmodelversion handler in mlflow/server/handlers.py uses a client-controlled tag to decide whether to skip source path validation. When a CreateModelVersion request includes the tag mlflow.prompt.isprompt, the helper ispromptrequest returns True, and the entire source validation block...

ROS-20260129-73-0051

A vulnerability in the Request Handling component of Mozilla Firefox, Firefox ESR and Thunderbird email client is related to the lack of validation of the data or message source. Exploitation of the vulnerability could allow a remote attacker to bypass existing security restrictions...

Foxit PDF Editor 安全漏洞

Foxit PDF Editor is a PDF editor from the Chinese company Foxit Foxit. A security vulnerability exists in Foxit PDF Editor, which stems from the postMessage handler not validating the source of a message, and could lead to stored cross-site scripting...

ROS-20251202-03

Vulnerability in DecodeConfig component of Golang programming language is related to uncontrolled consumption of resources. resources. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial-of-service condition. denial of service A vulnerability in the Downloa...

The vulnerability of the Nagios XI monitoring tool, related to a data source validation error, allows attackers to carry out phishing attacks.

The vulnerability of the Nagios XI monitoring tool is related to an error in data source validation when processing HTTP headers. Exploiting this vulnerability allows a malicious actor to perform phishing attacks remotely...

ROS-20251029-05

The vulnerability in the pgAdmin 4 database management tool is related to a flaw in the mechanism for source validation. Exploitation of the vulnerability could allow an attacker acting remotely, gain unauthorized access to protected information...

Exploit for Authentication Bypass by Spoofing in Dataease

fofa语法：title="DataEase" poc: "POST /de2api/datasource/validate...

Apollo Studio Embeddable Explorer & Embeddable Sandbox 跨站请求伪造漏洞

Apollo Studio Embeddable Explorer & Embeddable Sandbox is an open source vectorization tool for Apollo GraphQL. A cross-site request forgery vulnerability exists in Apollo Studio Embeddable Explorer & Embeddable Sandbox, which stems from a lack of source validation when client code handles the...

Omni Wireguard SideroLink potential escape

Overview Omni and each Talos machine establish a peer-to-peer P2P SideroLink connection using WireGuard to mutually authenticate and authorize access. In this setup, Omni assigns a random IPv6 address to each Talos machine from a /64 network block. Omni itself uses the fixed ::1 address within th...

Akinsoft OctoCloud Source Validation Error Vulnerability

Akinsoft OctoCloud is an online platform from Akinsoft Turkey with the ability to manage financial transactions, record receipts and inventory, issue invoices, and generate reports. A source validation error vulnerability exists in versions prior to Akinsoft OctoCloud s1.09.01 through v1.11.01,...

LimonDesk 访问控制错误漏洞

LimonDesk is a real-time chat, work order ticketing, and other features from LimonDesk, a Turkish company. An access control error vulnerability exists in LimonDesk s1.02.14 through versions prior to v1.ylabel17, which stems from a source validation error that could lead to forced browsing...

Akinsoft OctoCloud 访问控制错误漏洞

Akinsoft OctoCloud is an online platform from Akinsoft Turkey with the ability to manage financial transactions, record receipts and inventory, issue invoices, and generate reports. A source validation error vulnerability exists in versions prior to Akinsoft OctoCloud s1.09.01 through v1.11.01,...

rtpengine 访问控制错误漏洞

rtpengine is a media proxy software from Sipwise Open Source. An access control error vulnerability exists in rtpengine versions prior to 13.4.1.1, which stems from a source validation error in the endpoint learning logic that could lead to the injection or interception of RTP/SRTP media streams...

TruChain: a Multi-Layer Architecture for Trusted, Verifiable, and Immutable Open Banking Data

Open banking framework enables third party providers to access financial data across banking institutions, leading to unprecedented innovations in the financial sector. However, some open banking standards remain susceptible to severe technological risks, including unverified data sources,...

CVE-2020-0932

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0920, CVE-2020-0929, CVE-2020-0931, CVE-2020-0971,...

CVE-2025-22623

Ad Inserter - Ad Manager and AdSense Ads 2.8.0 was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/includes/dst/dst.php...

CVE-2024-7595

CVE-2024-7595 is documented with concrete details in connected sources: Junos OS exposes a GRE/GRE6 vulnerability where the protocol stack does not verify the source of tunneled packets. The issue arises when GRE/GRE6 is configured without authentication or filtering, enabling a remote attacker t...

CVE-2024-7595 GRE and GRE6 Protocols (RFC2784) do not validate or verify the source of a network packet

GRE and GRE6 Protocols RFC2784 do not validate or verify the source of a network packet allowing an attacker to spoof and route arbitrary traffic via an exposed network interface that can lead to spoofing, access control bypass, and other unexpected network behaviors. This can be considered simil...