315 matches found
Nginx-CVE-2013-4547
Nginx 文件名逻辑漏洞（CVE-2013-4547） 漏洞说明 影响版本：Nginx 0.8.41 1.4.3 / 1.5.0 1.5.7 参考链接： https://vulners.com/cve/CVE-2013-4547 https://blog.werner.wiki/file-resolution-vulnerability-nginx/ http://www.91ri.org/9064.html 漏洞说明 这个漏洞其实和代码执行没有太大关系，其主要原因是错误地解析了请求的URI，错误地获取到用户请求的文件名，导致出现权限绕过、代码执行的连带影响。...
PT-2026-90508
libks provides foundational support for signalwire C products. Prior to version 2.0.11, clean uri in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with...
CVE-2025-63588
CVE-2025-63588 Cross-Site Scripting XSS Reflejado en el manejo de la ruta cmsimplexh de CMSimpleXH CVSS v3.1 Estimado: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N → 6.1 Medio CVE Asignado: CVE-2025-63588 Productos: CMSimpleXH - 1.8 Vendor: CMSimpleXH - https://www.cmsimple-xh.org/ Resumen Existe una...
fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization
A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier URI without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the...
fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies
A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier URI hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policie...
fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization
A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier URI without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the...
fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies
A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier URI hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policie...
fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies
A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier URI hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policie...
fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization
A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier URI without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the...
Linux Distros Unpatched Vulnerability : CVE-2026-59696
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose...
CVE-2026-84292 fast-uri vulnerable to authority injection via an unvalidated port in serialize
fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host t...
EUVD-2026-69229
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of digits. uristring:getport/1 passes the port substring to binarytointeger/1 with no length bound,...
fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects
A flaw was found in fast-uri, a software component used for parsing Uniform Resource Identifiers URIs in Node.js applications. This vulnerability arises from an issue in how fast-uri processes the scheme part of a URI, specifically when it contains special characters that are percent-encoded. An...
fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects
A flaw was found in fast-uri, a software component used for parsing Uniform Resource Identifiers URIs in Node.js applications. This vulnerability arises from an issue in how fast-uri processes the scheme part of a URI, specifically when it contains special characters that are percent-encoded. An...
fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects
A flaw was found in fast-uri, a software component used for parsing Uniform Resource Identifiers URIs in Node.js applications. This vulnerability arises from an issue in how fast-uri processes the scheme part of a URI, specifically when it contains special characters that are percent-encoded. An...
Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty
Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Transformation Advisor. Vulnerability Details CVEID:CVE-2026-75838 DESCRIPTION: DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in INPLACE sanitization whe...
CVE-2026-76172
A flaw was found in fast-uri, a software component used for parsing Uniform Resource Identifiers URIs in Node.js applications. This vulnerability arises from an issue in how fast-uri processes the scheme part of a URI, specifically when it contains special characters that are percent-encoded. An...
CVE-2026-75931
A flaw was found in fast-uri, a URI parser for Node.js. This vulnerability arises because the parser fails to consistently convert internationalized domain names IDN to their standard ASCII form when processing scheme-relative references. This inconsistency can lead to host confusion, where an...
[SECURITY] Fedora 43 Update: apr-util-1.6.5-1.fc43
The mission of the Apache Portable Runtime APR is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more...
Linux Distros Unpatched Vulnerability : CVE-2026-76172
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization...