Lucene search
+L

228 matches found

RedhatCVE
RedhatCVE
added 2026/09/11 11:36 a.m.5 views

CVE-2026-14978

A flaw was found in go-slug. A local attacker could bypass .terraformignore exclusions, leading to sensitive files being included in Terraform slug uploads. This is caused by improper handling of Unicode normalization during path matching. Mitigation Upgrade to go-slug 0.18.3 or later. Where an...

5.5CVSS0.00103EPSS
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/10 1:43 a.m.12 views

CVE-2026-26128

CVE-2026-26128 用于通过 Windows Active Directory 中的 Unicode 规范化利用 Kerberos 反射的 Python 工具。基于 Guillaume André / Synacktiv 的研究。 安装 这些工具仅兼容 Python 3.8+。从 GitHub 克隆仓库,安装依赖项,然后就可以使用了: root@kitploit: git clone https://github.com/jarnovandenbrink/CVE-2026-26128.git cd CVE-2026-26128 pip install -r...

7.8CVSS7.4AI score0.00621EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/10 1:34 a.m.7 views

CVE-2026-2395

CVE-2026-23950 CVE-2026-23950 的概念验证 - tar 包中的竞态条件漏洞。 描述 本仓库演示了 tar npm 包(版本 7.5.3)中的一个竞态条件漏洞,该漏洞允许在解压过程中发生文件冲突。该漏洞利用了 Unicode 规范化差异,其中 collisionss 和 collisionß 由于不区分大小写的冲突可能被视为同一文件。 漏洞详情 CVE ID :CVE-2026-23950 受影响包 :tar 受影响版本 :7.5.3 漏洞类型 :导致文件冲突的竞态条件 影响 :并行解压期间文件内容损坏/覆盖 工作原理 该漏洞利用程序创建一个包含两个文件的 ta...

9.8CVSS6.5AI score0.00468EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/09 2:21 a.m.7 views

CVE-2023-46404

CVE-2023-46404 PCRS 是由多伦多大学开发的用于在线编程练习的 Web 应用。 参见 Bitbucket 仓库: https://bitbucket.org/utmandrew/pcrs/src/3.11/ 摘要 PCRS 的“问题”(Questions)页面(包含代码提交功能)和“代码编辑器”(Code editor)页面存在通过逃逸 Python 沙箱实现远程代码执行(RCE)的漏洞。 详情 在 PCRS 实例中,可通过使用生成器对象实现远程代码执行。通过使用生成器帧(giframe)和 fback,脚本可以穿越沙箱栈帧,在非沙箱环境中执行恶意代码。此外,Unicod...

9.9CVSS8.2AI score0.01887EPSS
SaveExploits2References3
Kitploit
Kitploit
added 2026/09/08 10:55 p.m.6 views

CVE-2025-64458-Demo

CVE-2025-64458 — Django 重定向 DoS(Windows 平台) 描述 Django 重定向响应中的一个拒绝服务(DoS)问题,允许攻击者在构造重定向响应时,触发 URL 规范化期间过量的 CPU 消耗。在 Windows 平台上,Python 的 Unicode NFKC 规范化尤其缓慢。因此,使用攻击者控制的超大 Unicode URL 创建 HttpResponseRedirect/HttpResponsePermanentRedirect(或使用 django.shortcuts.redirect)会导致异常的处理时间,进而造成请求线程耗尽以及服务变慢/中断...

7.5CVSS7.6AI score0.01902EPSS
SaveExploits1References1
Kitploit
Kitploit
added 2026/09/08 10:45 p.m.6 views

CVE-2025-52488

DNN Unicode路径规范化 NTLM 哈希泄露利用工具 CVE-2025-52488 概述 此利用工具针对 DNN(原名 DotNetNuke)版本 6.0.0 至 10.0.1 之前版本的漏洞,允许攻击者通过 Unicode 路径规范化攻击泄露 NTLM 哈希。 漏洞详情 CVE ID : CVE-2025-52488 严重性 : 高危(CVSS 8.6) 受影响版本 : 6.0.0 至 10.0.1 之前 攻击向量 : 网络 认证 : 不需要 工作原理 该利用工具滥用 Windows/.NET 的特殊机制和 Unicode 规范化,强制目标 DNN 服务器向攻击者控制的服务器发...

8.6CVSS8.4AI score0.35847EPSS
SaveExploits1References1
IBM Security Bulletins
IBM Security Bulletins
added 2026/09/01 6:47 p.m.9 views

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation released in August 2026. Vulnerability Details CVEID:CVE-2026-12590 DESCRIPTION: Impact: In body-parser versions prior to 1.20.6...

9.8CVSS7AI score0.0063EPSS
SaveExploits3Affected Software2
EUVD
EUVD
added 2026/08/31 5:29 p.m.11 views

EUVD-2026-68681

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded RFC 5891, so a label...

5.8AI score0.00373EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/08/31 12:00 a.m.13 views

PT-2026-83938

Name of the Vulnerable Software and Affected Versions URI for Perl versions prior to 5.36 Description Missing normalization in nameprep causes non-NFC host names to be encoded into non-standard punycode labels. While nameprep lowercases host labels, it fails to perform Unicode normalization to Fo...

6.5CVSS5.8AI score0.00373EPSS
SaveExploits0References12
SUSE CVE
SUSE CVE
added 2026/08/25 1:44 a.m.5 views

SUSE CVE-2026-14978

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...

5.5CVSS5.8AI score0.00103EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
added 2026/08/22 12:00 a.m.12 views

FreeBSD : terraform -- exclusion bypass in .terraformignore handling (4496ae0c-9d7d-11f1-a655-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4496ae0c-9d7d-11f1-a655-3497f65b111b advisory. HashiCorp reports: Terraform bundles the go-slug library, which builds the archive uploaded to HCP...

5.5CVSS5.5AI score0.00103EPSS
SaveExploits0References4
HashiCorp Security Advisories
HashiCorp Security Advisories
added 2026/08/20 7:40 p.m.12 views

Go-slug vulnerable to exclusion bypass in .terraformignore handling

Summary The github.com/hashicorp/go-slug library before v0.18.3 is vulnerable to an exclusion bypass in .terraformignore handling that may allow files intended to be excluded from Terraform Cloud or Terraform Enterprise working directory uploads to be included instead on affected macOS filesystem...

5.5CVSS5.5AI score0.00103EPSS
SaveExploits0Affected Software1
FreeBSD
FreeBSD
added 2026/08/20 12:00 a.m.23 views

terraform -- exclusion bypass in .terraformignore handling

HashiCorp reports: Terraform bundles the go-slug library, which builds the archive uploaded to HCP Terraform or Terraform Enterprise when a run is started. In go-slug before v0.18.3, matching of .terraformignore rules does not consistently treat canonically equivalent Unicode filenames as the sam...

5.5CVSS5.5AI score0.00103EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/19 9:16 p.m.4 views

CVE-2026-14978

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...

5.5CVSS5.8AI score
SaveExploits0References1
NVD
NVD
added 2026/08/19 9:16 p.m.17 views

CVE-2026-14978

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...

5.5CVSS0.00103EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/19 9:08 p.m.15 views

EUVD-2026-63099

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...

5.5CVSS5.2AI score0.00103EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/19 9:08 p.m.59 views

CVE-2026-14978

go-slug v0.4.0-v0.18.2 mishandles Unicode normalization during .terraformignore matching (CWE-176), allowing files differing only by normalization form to bypass exclusions and be uploaded to Terraform Cloud/Enterprise, exposing sensitive local files. Fixed in v0.18.3; no workaround provided. Exp...

5.5CVSS5.2AI score0.00103EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2026/08/19 9:08 p.m.50 views

CVE-2026-14978 Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...

5.5CVSS0.00103EPSS
SaveExploits0References1
IBM Security Bulletins
IBM Security Bulletins
added 2026/08/19 6:01 p.m.12 views

Security Bulletin: Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions

Summary The github.com/hashicorp/go-slug library before v0.18.3 is vulnerable to an exclusion bypass in .terraformignore handling that may allow files intended to be excluded from Terraform Cloud or Terraform Enterprise working directory uploads to be included instead on affected macOS filesystem...

5.5CVSS5.5AI score0.00103EPSS
SaveExploits0Affected Software1
Positive Technologies
Positive Technologies
added 2026/08/19 12:00 a.m.24 views

PT-2026-78711

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...

5.5CVSS5.2AI score0.00103EPSS
SaveExploits0References2
Rows per page
Query Builder