5410 matches found
CVE-2026-30932 Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API
Froxlor is open source server administration software. Prior to version 2.3.5, the DomainZones.add API endpoint accessible to customers with DNS enabled does not validate the content field for several DNS record types LOC, RP, SSHFP, TLSA. An attacker can inject newlines and BIND zone file...
CVE-2026-30932 Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API
Froxlor is open source server administration software. Prior to version 2.3.5, the DomainZones.add API endpoint accessible to customers with DNS enabled does not validate the content field for several DNS record types LOC, RP, SSHFP, TLSA. An attacker can inject newlines and BIND zone file...
CVE-2026-30932 Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API
Froxlor is open source server administration software. Prior to version 2.3.5, the DomainZones.add API endpoint accessible to customers with DNS enabled does not validate the content field for several DNS record types LOC, RP, SSHFP, TLSA. An attacker can inject newlines and BIND zone file...
EUVD-2026-14964
Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API...
Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API
Summary The DomainZones.add API endpoint accessible to customers with DNS enabled does not validate the content field for several DNS record types LOC, RP, SSHFP, TLSA. An attacker can inject newlines and BIND zone file directives e.g. $INCLUDE into the zone file that gets written to disk when th...
CVE-2026-30932: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Froxlor is open source server administration software. Prior to version 2.3.5, the DomainZones.add API endpoint accessible to customers with DNS enabled does not validate the content field for several DNS record types LOC, RP, SSHFP, TLSA. An attacker can inject newlines and BIND zone file...
‘CanisterWorm’ Springs Wiper Attack Targeting Iran
A financially motivated data theft and extortion group is attempting to inject itself into the Iran war, unleashing a worm that spreads through poorly secured cloud services and wipes data on infected systems that use Iran's time zone or have Farsi set as the default language. Experts say the wip...
Exploit for CVE-2024-51347
CVE-2024-51347: Unauthenticated Remote Code Execution in LSC I...
CVE-2026-4466
A vulnerability has been found in Comfast CF-AC100 2.6.0.8. This affects an unknown function of the file /cgi-bin/mbox-config?method=SET§ion=ntptimezone. The manipulation leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public an...
PT-2026-26537
A vulnerability has been found in Comfast CF-AC100 2.6.0.8. This affects an unknown function of the file /cgi-bin/mbox-config?method=SET§ion=ntp timezone. The manipulation leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public a...
WordPress Education Zone theme <= 1.3.8 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by John P in WordPress Theme Education Zone versions = 1.3.8...
SUSE CVE-2010-4326
Multiple buffer overflows in gwwww1.dll in GroupWise Internet Agent GWIA in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via variables in a VCALENDAR message, as demonstrated by a long 1 REQUEST-STATUS, 2 TZNAME, 3 COMMENT, or 4 RRULE variable in this message...
CVE-2026-23674
Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network...
MapUrlToZone Security Feature Bypass Vulnerability
Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network...
The vulnerability of the `btrfs_load_block_group_zone_info()` function in the `fs/btrfs/zoned.c` file of the btrfs file system in the Linux operating system allows a hacker to cause a service failure.
The vulnerability of the btrfsloadblockgroupzoneinfo function in the fs/btrfs/zoned.c file of the btrfs file system in Linux kernel affects the memory management mechanism. Exploiting this vulnerability can allow an attacker to cause a service failure...
kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting
A flaw was found in the Linux kernel's device mapper dm component. When setting up zone append emulation resources, a race condition can occur if the blkrevalidatediskzones function fails while another process simultaneously calls dmblkreportzones. This timing issue can lead to a use-after-free...
kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting
A flaw was found in the Linux kernel's device mapper dm component. When setting up zone append emulation resources, a race condition can occur if the blkrevalidatediskzones function fails while another process simultaneously calls dmblkreportzones. This timing issue can lead to a use-after-free...
Exploit for CVE-2024-51482
Security Research: Multi-Stage Exploitation of Web-Based Surve...
