83093 matches found
CVE-2026-107180 MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances
On MISP instances configured to require TOTP enrolment Security.otprequired, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...
EUVD-2026-94318
On MISP instances configured to require TOTP enrolment Security.otprequired, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...
CVE-2026-107180 MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances
On MISP instances configured to require TOTP enrolment Security.otprequired, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...
CVE-2026-107180
On MISP instances where Security.otp_required is enabled, a logic flaw allows authenticated users to bypass mandatory TOTP enrolment . The enforcement mechanism only applied to standard browser requests; consequently, users could bypass the setup by issuing non-browser requests such as AJAX/XHR c...
CVE-2026-107180 MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances
On MISP instances configured to require TOTP enrolment Security.otprequired, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...
CVE-2026-105138 Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API
Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...
EUVD-2026-94309
Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...
CVE-2026-105138
The Obot platform versions 0.12.0 before 0.26.2 is vulnerable to a credential exposure flaw in the MCP Catalog Entry API . Due to insufficiently protected credentials, authenticated basic users with access to an entry can perform a GET request to /api/all-mcps/entries/{entry_id}. This action allo...
CVE-2026-105138 Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API
Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...
CVE-2026-105138 Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API
Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...
CVE-2026-104073
A flaw was found in NetBox. An authenticated user with permission to create custom links can exploit a template injection vulnerability to access sensitive session information and Application Programming Interface API tokens. When a victim views an object containing the malicious link, their...
CVE-2026-85706
CVE-2026-85706 GitLab 비인증 임의 파일 읽기 ★ CVE-2026-85706 GitLab 비인증 임의 파일 읽기 PoC ★ https://github.com/user-attachments/assets/026749ec-04e9-4dd5-9453-cb7c1f6e823d 개요 CVE-2026-85706 은 GitLab CE/EE 의 비인증 임의 파일 읽기 취약점CVSS 10.0, CISA KEV으로, POST /api/v4/projects/:id/repository/commits를 통해 악용됩니다. 이 엔드포인트의...
SessionReaper-CVE-2025-54236
SessionReaper — CVE-2025-54236 CVE-2025-54236 "SessionReaper"를 위한 통합 PoC, Magento 2 / Adobe Commerce의 REST API에서 중첩 역직렬화를 통한 중요한 인증되지 않은 RCE입니다. CVSS: 9.1 심각 근본 원인: 부적절한 입력 검증 CWE-20; 익스플로잇 기본 요소는 안전하지 않은 역직렬화 CWE-502 최초 연구자: Daniel "Blaklis" Le Gall HackerOne을 통한 책임 공개 명명자: Sansec 수정 버전: Adobe...
CVE-2024-39722
Ollama CVE-2024-39722 익스플로잇 도구 이 도구는 Ollama 버전 0.1.45 이하에서 발생하는 모델 존재 여부 노출 취약점인 CVE-2024-39722를 익스플로잇하기 위해 설계되었습니다. 사용자는 Ollama 서버가 취약한지 확인하고 서버에 존재하는 모델을 발견하려 시도할 수 있습니다. 또한 공식 Ollama 모델 라이브러리를 크롤링하여 테스트할 잠재적 모델 목록을 생성할 수 있습니다. 中文 취약점 세부 정보 CVE ID: CVE-2024-39722 설명: Ollama 버전 0.1.45 이하는 모델 존재 ...
SmartAsset-CORS-CVE-2020-26527
SmartAsset-CORS-CVE-2020-26527 CVE-2020-26527 Smart Asset - 버전 2020.7 Damstra Smart Asset 2020.7의 API/api/Version에서 문제가 발견되었습니다. 교차 출처 리소스 공유CORS가 무작위 출처를 신뢰하여 임의의 'Origin: example.com' 헤더를 수락하고 200 OK 및 와일드카드 'Access-Control-Allow-Origin: ' 헤더로 응답합니다. HTTP Request: GET /API/api/Version HTTP/1.1...
CVE-2026-107103
This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint. Successful exploitation o...
CVE-2026-107102
This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating the parameter to cause the application to establish an...
CVE-2022-2414
CVE-2022-2414 CVE-2022-2414 POC 1. Замените YOURHOST на вашу цель, как в URL ниже url = "https://example.com/ca/rest/certrequests"...
CVE-2026-107103 SQL Injection Vulnerability in Manacle Technologies ERP System
This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint. Successful exploitation o...
EUVD-2026-94218
This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint. Successful exploitation o...