privaxy

Privaxy Blocco di tracker e pubblicità di nuova generazione Informazioni Privaxy è un proxy MITM HTTPs che si frappone tra applicazioni che comunicano tramite HTTPs, come un browser web, e server HTTP, come quelli che servono siti web. Stabilendo un tunnel bidirezionale tra le due estremità,...

CVE-2018-1305

Apache Tomcat Vulnerabilità di bypass della sicurezza Recentemente, Apache ha rilasciato un avviso di sicurezza affermando che diverse versioni di Apache Tomcat 7, 8 e 9 presentano una vulnerabilità di bypass della sicurezza. Un attaccante può sfruttare questo problema per aggirare alcune...

cve-2026-43515-poc

CVE-2026-43515 — Apache Tomcat Sicherheitsbeschränkungsumgehung Ausnutzbarkeitsurteil: bestätigt ausnutzbar. Eine POST-Anfrage an eine Ressource, die durch eine geteilte -Konfiguration geschützt wird, umgeht die Authentifizierung vollständig. Die erforderliche web.xml-Struktur ist in...

PT-2026-99946

Name of the Vulnerable Software and Affected Versions Axios versions 1.16.1 through 1.19.x Description A regular expression used for RFC 2397 compliance allows slash characters on both sides of the media-type separator. When an application processes a malformed data URL containing numerous slash...

Open Redirect

Spring Framework is vulnerable to an open redirect. The vulnerability is due to insufficiently restrictive URL pattern matching, which allows an attacker to manipulate a URL and redirect a victim to an attacker-controlled external destination...

CVE-2026-55520

Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego.urlpattern.URLPattern.preparepatternforregex translates every asterisk in an Allow or Disallow directive into a lazy regular-expression wildcard, so a directive containing many asterisks create...

CVE-2026-72818 NLTK TweetTokenizer URL Pattern Backtracks Catastrophically on Naked-Domain-Like Input

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned in...

CVE-2026-72818 NLTK TweetTokenizer URL Pattern Backtracks Catastrophically on Naked-Domain-Like Input

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned in...

Exploit for Improper Authorization in Apache Tomcat

CVE-2026-43515 — Apache Tomcat Security Constraint Bypass...

EUVD-2026-25964

A weakness has been identified in dvladimirov MCP up to 0.1.0. The impacted element is the function GitSearchRequest of the file mcpserver.py of the component Git Search API. Executing a manipulation of the argument repourl/pattern can lead to command injection. The attack can be executed remotel...

EUVD-2004-0709

Malware in sbrugna...

EUVD-2005-4750

Malware in sbrugna...

EUVD-2018-0634

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2016-5007

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping...

CVE-2005-4757

BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, do not properly "constrain" a "/" slash servlet root URL pattern, which might allow remote attackers to bypass intended servlet protections...

Oracle Linux 7 : tomcat (ELSA-2019-2205)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2205 advisory. - Resolves: rhbz1641873 CVE-2018-11784 tomcat: Open redirect in default servlet - Resolves: rhbz1552375 CVE-2018-1304 tomcat: Incorrect handling of emp...

K04623854: Apache Tomcat vulnerability CVE-2018-1304

Security Advisory Description The URL pattern of "" the empty string which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the...

GHSA-VP56-6G26-6827 node-fetch Inefficient Regular Expression Complexity

node-fetch is a light-weight module that brings window.fetch to node.js. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the isOriginPotentiallyTrustworthy function in referrer.js, when processing a URL string with alternating letters and periods,...

CVE-2022-21195

All versions of package url-regex are vulnerable to Regular Expression Denial of Service ReDoS which can cause the CPU usage to crash...

jetty: full server path revealed when using the default Error Handling

In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a...