Lucene search
+L

228 matches found

RedhatCVE
RedhatCVE
added 2026/09/11 11:36 a.m.4 views

CVE-2026-14978

A flaw was found in go-slug. A local attacker could bypass .terraformignore exclusions, leading to sensitive files being included in Terraform slug uploads. This is caused by improper handling of Unicode normalization during path matching. Mitigation Upgrade to go-slug 0.18.3 or later. Where an...

5.5CVSS0.00103EPSS
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/10 1:43 a.m.12 views

CVE-2026-26128

CVE-2026-26128 Herramienta en Python para explotar la reflexión de Kerberos mediante la normalización Unicode en Windows Active Directory. Basada en la investigación de Guillaume André / Synacktiv. Instalación Estas herramientas solo son compatibles con Python 3.8+. Clona el repositorio desde...

7.8CVSS7.4AI score0.00621EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/10 1:34 a.m.7 views

CVE-2026-2395

CVE-2026-23950 Prueba de concepto para CVE-2026-23950 - Vulnerabilidad de condición de carrera en el paquete tar. Descripción Este repositorio demuestra una vulnerabilidad de condición de carrera en el paquete npm tar versión 7.5.3 que permite la colisión de archivos durante la extracción. La...

9.8CVSS6.5AI score0.00468EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/09 2:21 a.m.7 views

CVE-2023-46404

CVE-2023-46404 PCRS is a webapp for online programming exercises developed at the University of Toronto. See Bitbucket repository: https://bitbucket.org/utmandrew/pcrs/src/3.11/ Summary PCRS “Questions” page with code submission and “Code editor” page are vulnerable to remote code execution RCE b...

9.9CVSS8.2AI score0.01887EPSS
SaveExploits2References3
Kitploit
Kitploit
added 2026/09/08 10:55 p.m.6 views

CVE-2025-64458-Demo

CVE-2025-64458 — DoS de Redirección en Django en Windows Descripción Un problema de denegación de servicio DoS en las respuestas de redirección de Django permite a un atacante provocar un trabajo excesivo de la CPU durante la normalización de URL al construir respuestas de redirección. En Windows...

7.5CVSS7.6AI score0.01902EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/08 10:45 p.m.6 views

CVE-2025-52488

DNN Unicode路径规范化 NTLM 哈希泄露利用工具 CVE-2025-52488 概述 此利用工具针对 DNN(原名 DotNetNuke)版本 6.0.0 至 10.0.1 之前版本的漏洞,允许攻击者通过 Unicode 路径规范化攻击泄露 NTLM 哈希。 漏洞详情 CVE ID : CVE-2025-52488 严重性 : 高危(CVSS 8.6) 受影响版本 : 6.0.0 至 10.0.1 之前 攻击向量 : 网络 认证 : 不需要 工作原理 该利用工具滥用 Windows/.NET 的特殊机制和 Unicode 规范化,强制目标 DNN 服务器向攻击者控制的服务器发...

8.6CVSS8.4AI score0.35847EPSS
SaveExploits1References1
IBM Security Bulletins
IBM Security Bulletins
added 2026/09/01 6:47 p.m.8 views

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation released in August 2026. Vulnerability Details CVEID:CVE-2026-12590 DESCRIPTION: Impact: In body-parser versions prior to 1.20.6...

9.8CVSS7AI score0.0063EPSS
SaveExploits3Affected Software2
EUVD
EUVD
added 2026/08/31 5:29 p.m.11 views

EUVD-2026-68681

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded RFC 5891, so a label...

5.8AI score0.00373EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/08/31 12:00 a.m.12 views

PT-2026-83938

Name of the Vulnerable Software and Affected Versions URI for Perl versions prior to 5.36 Description Missing normalization in nameprep causes non-NFC host names to be encoded into non-standard punycode labels. While nameprep lowercases host labels, it fails to perform Unicode normalization to Fo...

6.5CVSS5.8AI score0.00373EPSS
SaveExploits0References12
SUSE CVE
SUSE CVE
added 2026/08/25 1:44 a.m.5 views

SUSE CVE-2026-14978

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...

5.5CVSS5.8AI score0.00103EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
added 2026/08/22 12:00 a.m.12 views

FreeBSD : terraform -- exclusion bypass in .terraformignore handling (4496ae0c-9d7d-11f1-a655-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4496ae0c-9d7d-11f1-a655-3497f65b111b advisory. HashiCorp reports: Terraform bundles the go-slug library, which builds the archive uploaded to HCP...

5.5CVSS5.5AI score0.00103EPSS
SaveExploits0References4
HashiCorp Security Advisories
HashiCorp Security Advisories
added 2026/08/20 7:40 p.m.12 views

Go-slug vulnerable to exclusion bypass in .terraformignore handling

Summary The github.com/hashicorp/go-slug library before v0.18.3 is vulnerable to an exclusion bypass in .terraformignore handling that may allow files intended to be excluded from Terraform Cloud or Terraform Enterprise working directory uploads to be included instead on affected macOS filesystem...

5.5CVSS5.5AI score0.00103EPSS
SaveExploits0Affected Software1
FreeBSD
FreeBSD
added 2026/08/20 12:00 a.m.23 views

terraform -- exclusion bypass in .terraformignore handling

HashiCorp reports: Terraform bundles the go-slug library, which builds the archive uploaded to HCP Terraform or Terraform Enterprise when a run is started. In go-slug before v0.18.3, matching of .terraformignore rules does not consistently treat canonically equivalent Unicode filenames as the sam...

5.5CVSS5.5AI score0.00103EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/19 9:16 p.m.4 views

CVE-2026-14978

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...

5.5CVSS5.8AI score
SaveExploits0References1
NVD
NVD
added 2026/08/19 9:16 p.m.17 views

CVE-2026-14978

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...

5.5CVSS0.00103EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/19 9:08 p.m.15 views

EUVD-2026-63099

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...

5.5CVSS5.2AI score0.00103EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/19 9:08 p.m.59 views

CVE-2026-14978

go-slug v0.4.0-v0.18.2 mishandles Unicode normalization during .terraformignore matching (CWE-176), allowing files differing only by normalization form to bypass exclusions and be uploaded to Terraform Cloud/Enterprise, exposing sensitive local files. Fixed in v0.18.3; no workaround provided. Exp...

5.5CVSS5.2AI score0.00103EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2026/08/19 9:08 p.m.50 views

CVE-2026-14978 Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...

5.5CVSS0.00103EPSS
SaveExploits0References1
IBM Security Bulletins
IBM Security Bulletins
added 2026/08/19 6:01 p.m.12 views

Security Bulletin: Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions

Summary The github.com/hashicorp/go-slug library before v0.18.3 is vulnerable to an exclusion bypass in .terraformignore handling that may allow files intended to be excluded from Terraform Cloud or Terraform Enterprise working directory uploads to be included instead on affected macOS filesystem...

5.5CVSS5.5AI score0.00103EPSS
SaveExploits0Affected Software1
Positive Technologies
Positive Technologies
added 2026/08/19 12:00 a.m.24 views

PT-2026-78711

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...

5.5CVSS5.2AI score0.00103EPSS
SaveExploits0References2
Rows per page
Query Builder