198 matches found
CVE-2025-55752
CVE-2025-55752: Apache Tomcat Path-Traversal-Sicherheitslücke Docker-basierte Umgebung zur Reproduktion der Path-Traversal-Sicherheitslücke CVE-2025-55752 in Apache Tomcat 10.1.44. Übersicht CVE-2025-55752 ist eine Path-Traversal-Sicherheitslücke in der RewriteValve-Komponente von Apache Tomcat,...
CVE-2025-55752
🚨🚨 CVE-2025-55752 — Apache Tomcat: Bypass de proteção de diretórios via Rewrite Valve → RCE via PUT🚨🚨 Resumo A CVE-2025-55752 é uma regressão de segurança no Apache Tomcat introduzida durante a correção do bug 60013. Quando o Rewrite Valve é utilizado, o Tomcat aplica a normalização de caminho...
CVE-2025-47273-PoC
CVE-2025-47273: setuptools versione 78.1.0 - Path Traversal in setuptools.packageindex Dichiarazione di non responsabilità Questa Proof of Concept PoC è intesa esclusivamente a scopo educativo e per audit di sicurezza autorizzati. L'autore non si assume alcuna responsabilità per l'uso improprio d...
CVE-2021-41773-POC
CVE-2021-41773-POC La documentazione del POC e della configurazione del laboratorio per CVE 2021 41773 Cos'è CVE-2021-41773? CVE-2021-41773 è una vulnerabilità di path traversal in Apache HTTP Server 2.4.49 e 2.4.50. Questa vulnerabilità sfrutta un aggiornamento nel codice di normalizzazione dei...
CVE-2026-73628
Serendipity versions = 2.3.5 and . In include/functionsrouting.inc.php serveSearch, the sanitisation pipeline runs urldecode after HTML-encoding, so a single URL-encoded HTML payload survives striptags and htmlspecialchars and is then decoded back into live HTML in the page. A crafted search link...
EulerOS 2.0 SP13 : mutt (EulerOS-SA-2026-2982)
According to the versions of the mutt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP authcram MD5 digest.CVE-2026-43859 In mutt before 2.3.2, the imapauthgss...
EUVD-2026-51612
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, fileloader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILELOADERROOTPATH through watermark or frame filter input. This issue is fixed in 7.8.0...
CVE-2026-59083 Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass
Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0...
CVE-2026-59083 Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass
Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0...
CVE-2026-59083
Apache Tomcat is affected by CVE-2026-59083 due to incorrect URL decoding in RewriteValve, enabling a possible security constraint bypass for certain configurations. Affected branches include 11.0.0-M1–11.0.23, 10.1.0-M1–10.1.56, 9.0.0.M1–9.0.119, and 8.5.0–8.5.100. Remediation is to upgrade to f...
CVE-2026-12243
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
SUSE SLED15 / SLES15 Security Update : python-PyJWT (SUSE-SU-2026:2626-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2626-1 advisory. This update for python-PyJWT fixes the following issues - CVE-2026-48522: PyJWKClient passes URI arguments...
CVE-2026-54414
FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint /api/folder/uploadToSharedFolder.php, leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename and REGEXFILENAME, which permit...
SUSE SLES12 Security Update : mutt (SUSE-SU-2026:2300-1)
The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2300-1 advisory. This update for mutt fixes the following issues - CVE-2026-43859: strfcpy used instead of memcpy for the IMAP authcram MD5 digest bsc1263897. -...
MAL-2026-5580 Malicious code in webpack-cache-reset (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fee0027f45dd4846b52b99120af39a0bca88f8693047612e946cd8d816f36e6c On npm install, the package's postinstall hook runs loader.js, which hex-decodes the URL https://jsonkeeper.com/b/INN1F an anonymous JSON paste host,...
Security update for mutt
This update for mutt fixes the following issues CVE-2026-43859: strfcpy used instead of memcpy for the IMAP authcram MD5 digest bsc1263897. CVE-2026-43860: truncation of hashpasswd by one byte for IMAP authcram MD5 digest bsc1263896. CVE-2026-43861: missing check for \0 in urlpctdecode bsc1263895...
SUSE-SU-2026:2301-1 Security update for mutt
This update for mutt fixes the following issues - CVE-2026-43859: strfcpy used instead of memcpy for the IMAP authcram MD5 digest bsc1263897. - CVE-2026-43860: truncation of hashpasswd by one byte for IMAP authcram MD5 digest bsc1263896. - CVE-2026-43861: missing check for \0 in urlpctdecode...
EUVD-2026-30359
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, he tooltip mouseover handler in app/src/block/popover.ts reads aria-label via getAttribute and passes it through decodeURIComponent before assigning to messageElement.innerHTML in app/src/dialog/tooltip.ts:41. The...
CVE-2026-43861
A flaw was found in mutt, an email client. The urlpctdecode function, which is responsible for decoding URL-encoded strings, does not correctly handle null termination characters. This vulnerability could allow a remote attacker, to manipulate how URLs are processed, potentially leading to a...