CVE-2026-61835

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, the SSRF protection on Directus's file-import-from-URL feature can be bypassed using the address 0.0.0.0 because api/src/request/is-denied-ip.ts treats 0.0.0.0 as a keyword for local interfaces but...

Fides Webserver API Rate Limiting Vulnerability in Proxied Environments

SummaryThe Fides Webserver API's built-in IP-based rate limiting is ineffective in environments with CDNs, proxies or load balancers. The system incorrectly applies rate limits based on directly connected infrastructure IPs rather than client IPs, and stores counters in-memory rather than in a...

password leak with netrc and user in URL

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username without a password, like https://[email protected]/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is n...

CVE-2026-48165 MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrepsstreceiveaddress or wsrepsstdonor global system...

Couchbase .NET SDK (client library) does not properly enable hostname verification for TLS certificates

The Couchbase .NET SDK client library before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default...

CVE-2025-49015

The Couchbase .NET SDK (client library) versions prior to 3.7.1 are vulnerable to improper certificate validation. The root cause is that hostname verification for TLS certificates is not properly enabled, and a configuration option incorrectly enabled by default causes the SDK to use IP addresse...

cups-filters: libcupsfilters: `cfGetPrinterAttributes` API does not perform sanitization on returned IPP attributes

A flaw was found in OpenPrinting CUPS. In certain conditions, a remote attacker can add a malicious printer or directly hijack an existing printer by replacing the valid IPP URL with a malicious one. Also, it is possible that due to a lack of validation of IPP attributes returned by the server,...

The vulnerability of the MMS processor in the VideoLAN VLC media player software allows a hacker to influence the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the MMS processor in the VideoLAN VLC media player lies in the possibility of buffer overflow attacks. Exploiting this vulnerability allows a malicious actor to influence the confidentiality, integrity, and accessibility of the protected information by downloading specially...

GSD-2022-1000666 RDMA/cma: Use correct address when leaving multicast group

RDMA/cma: Use correct address when leaving multicast group This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.8 by commit...

CVE-2002-1962

Finjan Software SurfinGate 6.0 and 6.0 1 allows remote attackers to bypass URL access restrictions via a URL with an IP address instead of a hostname...

microsoft.privacy.issue.txt

Date: Tue, 11 May 1999 21:55:22 -0600 MDT From: cult hero To: InfoSec News Subject: ISN Everywhere your MAC address shows up Forwarded From: MICROSOFT'S HEAVY HAND IN THE COOKIE JAR A special report from YEOW - Barry Simon. See the Woody's Office Watch discussion and details on the Office 97...