CVE-2024-4956

CVE-2024-4956 - Nexus Repository Manager 3 中的未认证路径遍历漏洞 Nexus Repository Manager 是一个用于组织、存储和分发开发所需工件的仓库管理器。 在 3.68.1 之前的 Nexus Repository 3 版本中发现了一个路径遍历漏洞。该漏洞允许攻击者在不进行任何身份验证的情况下，构造 URL 下载 Nexus Repository 应用程序范围之外的系统文件。这带来了重大风险，因为它可能暴露敏感的系统文件，并可能危及安装了 Nexus Repository 的环境的安全性。 建议尽快将 Nexus Reposito...

CVE-2024-4956

CVE-2024-4956 - Nexus Repository Manager 3 中的未认证路径遍历漏洞 Nexus Repository Manager 是一个仓库管理器，用于组织、存储和分发开发所需的工件。 在 Nexus Repository 3 的 3.68.1 之前的版本中发现了一个路径遍历漏洞。该漏洞允许攻击者构造一个 URL，无需任何认证即可下载 Nexus Repository 应用程序范围之外的系统文件。这带来了重大风险，因为它可能暴露敏感的系统文件，并可能危及安装了 Nexus Repository 的环境的安全。 建议尽快将 Nexus Repository 更...

python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API

A flaw was found in the Python webbrowser.open API. If a specially crafted URL containing "%action" is processed, an attacker could bypass a previous mitigation for CVE-2026-4519. This bypass allows for command injection into the underlying shell, potentially leading to arbitrary code execution...

CVE-2026-31956

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to version 4.4.1, any authenticated user can manually construct a URL to preview campaigns/regions, and export saved reports belonging to other users. Exploitation of th...

python: Python: Command-line option injection in webbrowser.open() via crafted URLs

A flaw was found in Python. The webbrowser.open API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options,...

CVE-2026-25765

A flaw was found in Faraday, an HTTP client library. The buildexclusiveurl method, which combines a base URL with a user-supplied path, incorrectly processes protocol-relative URLs e.g., //evil.com/path. This allows a remote attacker to supply a specially crafted URL, leading to Server-Side Reque...

EUVD-2017-10141

Malware in sbrugna...

EUVD-2018-20682

Malware in sbrugna...

EUVD-2024-2676

Malicious code in bioql PyPI...

EUVD-2022-5736

Malicious code in bioql PyPI...

EUVD-2022-2491

Malicious code in bioql PyPI...

EUVD-2024-2787

Malicious code in bioql PyPI...

CVE-2021-21679

Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...

CVE-2025-30164

The CVE-2025-30164 issue in Icinga Web 2 is an open redirect vulnerability affecting versions before 2.11.5 and 2.12.13, where an authenticated (or easily authenticated) user could be redirected to an arbitrary location via a crafted URL. The root cause is the backend’s redirect logic allowing ar...

CVE-2025-24398

Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 both inclusive allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...

CVE-2025-24398

The Jenkins Bitbucket Server Integration Plugin versions 2.1.0 through 4.1.3 (both inclusive) is vulnerable to a Cross-Site Request Forgery (CSRF) bypass . The root cause is an overly permissive implementation of a Jenkins extension point used to support OAuth 1.0 authentication, which selectivel...

CVE-2024-41732

SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls. Depending on the web applications provided by this server, the attacker might inject CSS code or links into the web application that could allow the attacker to read ...

CVE-2024-33536

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. The vulnerability occurs due to inadequate input validation of the res parameter, allowing an authenticated attacker to inject and execute arbitrary JavaScript code within the context of another user's browser session. By uploading...

BIT-AIRFLOW-2023-40712 Apache Airflow: Secrets can be unmasked in the "Rendered Template"

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI. Users are strongly...

Denial Of Service (DoS)

nuxt-api-party is vulnerable to Denial of Service DoS. The vulnerability could be exploited via crafting a malicious URL and setting high retry attempts, which allows an attacker to trigger a recursive error handling loop, crashing the server and potentially disrupting service for legitimate user...