Azure-APIM-Cross-Tenant-Signup-Bypass

Azure APIM 크로스 테넌트 가입 우회 상태01.12.2025: 이 취약점은 여전히 활성 상태이며 악용 가능합니다. Microsoft는 이 문제를 패치하지 않았으며 이를 "의도된 설계by design"로 간주합니다. 보안 권고 GHSA-vcwf-73jp-r7mv CVE-2025-66390 요약 Azure API ManagementAPIM Developer Portal의 보안 취약점으로 인해, 관리자가 포털 UI에서 사용자 가입을 비활성화했더라도 공격자는 기본 인증Basic Authentication이 활성화된 모든 API...

dirty_sock

dirtysock: Linux 권한 상승 snapd를 통해 2019년 1월, 현재 버전의 Ubuntu Linux가 snapd API의 버그로 인해 로컬 권한 상승에 취약한 것으로 밝혀졌습니다. 이 저장소는 원본 익스플로잇 POC를 포함하며, 연구 및 교육 목적으로 제공됩니다. 취약점과 익스플로잇에 대한 자세한 설명은 여기 블로그 게시물을 참조하십시오. Ubuntu는 기본적으로 snapd를 제공하지만, 이 패키지가 설치된 모든 배포판에서 익스플로잇이 가능합니다. 시스템이 취약한지 쉽게 확인할 수 있습니다. 아래 명령어를 실행하세...

CVE-2026-35616

🚨 CVE-2026-35616 - FortiClient EMS 인증 우회 🚨 부적절한 접근 제어 | 사전 인증 API 우회 야생에서 악용됨 — 2026년 4월 📋 개요 CVE-2026-35616 은 FortiClient Enterprise Management Server EMS 버전 7.4.5 7.4.6 에서 발견된 치명적인 취약점입니다. 인증되지 않은 원격 공격자는 특수하게 조작된 요청을 전송하여 인증 및 권한 부여 검사를 우회할 수 있으며, 잠재적으로 인가되지 않은 코드 실행 또는 전체 서버 장악으로 이어질 수 있습니다...

CVE-2015-3073

CVE-2015-3073 이 취약점은 원격 공격자가 취약한 Adobe Reader 설치 환경에서 API 제한을 우회할 수 있도록 합니다. 이 취약점을 악용하려면 사용자 상호작용이 필요하며, 대상자가 악성 페이지를 방문하거나 악성 파일을 열어야 합니다. 구체적인 결함은 AFParseDate에 존재합니다. 특정 JavaScript 명령어를 포함한 특수 제작된 PDF를 생성하면 JavaScript API 제한을 우회할 수 있습니다. 원격 공격자는 이 취약점을 악용하여 임의 코드를 실행할 수 있습니다. Windows 및 OS X에서...

EUVD-2026-87691

Froxlor through 2.3.10 does not enforce the mail.allowexternaldomains policy in the EmailSender.add API command. When an administrator has enabled the allowed-sender feature but disabled external allowed-sender domains mail.enableallowsender = 1, mail.allowexternaldomains = 0, an authenticated...

CVE-2026-100718: Incorrect Default Permissions

Froxlor through 2.3.10 does not enforce the mail.allowexternaldomains policy in the EmailSender.add API command. When an administrator has enabled the allowed-sender feature but disabled external allowed-sender domains mail.enableallowsender = 1, mail.allowexternaldomains = 0, an authenticated...

CVE-2026-78153

The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users...

EUVD-2026-70042

The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users...

PT-2026-84715

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...

Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation

Impact When Full Multiple Companies Support and scopelocationsfmcs are both enabled, the API endpoint for creating locations can still create a child location under a parent location from a different company. The code detects the invalid parent/child company mismatch, but it appears not to return...

GHSA-8W8C-8MX9-52CW Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation

Impact When Full Multiple Companies Support and scopelocationsfmcs are both enabled, the API endpoint for creating locations can still create a child location under a parent location from a different company. The code detects the invalid parent/child company mismatch, but it appears not to return...

CVE-2026-17559

Passster (Content Protector) WordPress plugin versions before 4.3.9 contain an unauthenticated information disclosure vulnerability in its REST API path allowlist logic. The plugin compares its own public endpoint paths as an unanchored substring of the request URI rather than against the resolve...

Duplicati 2.2.0.3 JWT Signing Key Leak Bypass

Duplicati exposes the JWT signing key through a case-sensitive guard bypass in the settings endpoint. A GET request to /api/v1/serversetting/JWTConfig PascalCase bypasses the guard check for "jwt-config", allowing any authenticated user to retrieve the secret. With the extracted SigningKey,...

Mattermost Server 10.11.x < 10.11.22 / 11.7.x < 11.7.7 Multiple Vulnerabilities (MMSA-2026-00672, MMSA-2026-00675, MMSA-2026-00704)

The version of Mattermost Server installed on the remote host is affected by multiple vulnerabilities as referenced in the MMSA-2026-00672, MMSA-2026-00675, MMSA-2026-00704 advisories. - Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to prevent guest users from receiving Board Admin...

CVE-2026-19709 Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...

CVE-2026-55986 Email Management API Bypasses ManageCredentials Feature Restrictions

Email Management API Bypasses ManageCredentials Feature Restrictions...

CVE-2026-55986 Email Management API Bypasses ManageCredentials Feature Restrictions

Email Management API Bypasses ManageCredentials Feature Restrictions...

PT-2026-71700

Name of the Vulnerable Software and Affected Versions Email Management API affected versions not specified Description The Email Management API contains a flaw that allows the bypass of restrictions within the ManageCredentials feature. Recommendations At the moment, there is no information about...

PT-2026-71018

The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups...

CVE-2026-69117 NetBox 4.5.8 ORM Injection via WritableNestedSerializer

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any RES...