2060 matches found
CVE-2026-86186 AVideo API Rate Limit Bypass via Bot User-Agent Header
AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting and perform unlimited password guessing...
CVE-2026-86186 AVideo API Rate Limit Bypass via Bot User-Agent Header
AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting and perform unlimited password guessing...
CVE-2026-86186
AVideo is a video hosting platform whose API rate-limiting mechanism fails to account for requests carrying a bot User-Agent header . This allows an unauthenticated attacker to bypass all eight protected operations , including login brute-force protection , by simply setting a bot User-Agent stri...
EUVD-2026-72007
AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting and perform unlimited password guessing...
CVE-2021-44228
CVE-2021-44228 Using Log4j 2.14 library Vulnerable in User-Agent, POST method and entrypoint /admin/cores?foo= I have uploaded it in Docker Hub: you can pull and run it https://hub.docker.com/repository/docker/iamnewbie/log4j-vuln...
php-8.1.0-dev-backdoor-rce
PHP 8.1.0-dev Backdoor Remote Code Execution PHP 8.1.0-dev Backdoor System Shell Script PHP verion 8.1.0-dev was released with a backdoor on March 28th 2021, but the backdoor was quickly discovered and removed. If this version of PHP runs on a server, an attacker can execute arbitrary code by...
EUVD-2026-69721
WWBN AVideo current e01e41ecc and earlier makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder/isAVideoMobileApp checks match HTTPUSERAGENT against a hardcoded literal "AVideoEncoder"/"AVideoMobileApp" with no IP check or shared...
CVE-2026-84479
WWBN AVideo current e01e41ecc and earlier makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder/isAVideoMobileApp checks match HTTPUSERAGENT against a hardcoded literal "AVideoEncoder"/"AVideoMobileApp" with no IP check or shared...
CVE-2026-84479
WWBN AVideo (version e01e41ecc and earlier) contains an authentication bypass vulnerability where three login-time security controls rely solely on the client-supplied User-Agent header. The isAVideoEncoder() and isAVideoMobileApp() checks match HTTP_USER_AGENT against hardcoded literals ("AVideo...
CVE-2026-84479 WWBN AVideo Authentication Bypass via User-Agent Header
WWBN AVideo current e01e41ecc and earlier makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder/isAVideoMobileApp checks match HTTPUSERAGENT against a hardcoded literal "AVideoEncoder"/"AVideoMobileApp" with no IP check or shared...
CVE-2026-84479 WWBN AVideo Authentication Bypass via User-Agent Header
WWBN AVideo current e01e41ecc and earlier makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder/isAVideoMobileApp checks match HTTPUSERAGENT against a hardcoded literal "AVideoEncoder"/"AVideoMobileApp" with no IP check or shared...
PT-2026-84538
Name of the Vulnerable Software and Affected Versions WWBN AVideo versions e01e41ecc and earlier Description Three security controls during the login process rely exclusively on the client-supplied User-Agent header. The functions isAVideoEncoder and isAVideoMobileApp compare the HTTP USER AGENT...
Ray < 2.52.0 Remote Code Execution (CVE-2025-62593)
The Ray Dashboard service running on the remote host is prior to version 2.52.0. It is, therefore, affected by a remote code execution vulnerability: - Ray's browser-based attack protection relies solely on checking that the User-Agent header starts with 'Mozilla'. The Fetch specification allows...
CVE-2026-82644
WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...
CVE-2026-82644
WWBN AVideo (version e01e41ecc and earlier ) is vulnerable to a brute-force rate-limiting bypass in the enforceRateLimit() function, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer (ObjectYPT::setCacheGlobal ) that silently discards ...
CVE-2026-82644 WWBN AVideo Brute-force Rate Limiting Bypass via Missing User-Agent
WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...
Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
Log4Shell CVE-2021-44228 lab This repository contains a small...
PT-2026-83570
WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...