77191 matches found
CVE-2026-86684
The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...
CVE-2026-105268
The Gitea API routes for issue attachments /api/v1/repos/owner/repo/issues/index/assets/attachmentid also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete...
csf
ArmourBird CSF - Framework de Sécurité des Conteneurs Remarque : Le client CSF est en cours de développement actif et est en train d'être converti en GoLang pour de meilleures performances et architecture. Table des matières 1. À propos 2. Diagramme d'architecture 3. APIs du serveur CSF 4...
kiterunner
Kiterunner Introduction Pendant très longtemps, la découverte de contenu s'est concentrée sur la recherche de fichiers et de dossiers. Bien que cette approche soit efficace pour les serveurs web legacy qui hébergent des fichiers statiques ou répondent avec des 3xx’s sur un chemin partiel, elle...
CVE-2026-96594
The Gitea repository media API endpoint GET /api/v1/repos/{owner}/{repo}/media/{filepath} is vulnerable to stored Cross-Site Scripting (XSS) . The root cause is that the API fails to return appropriate content-type and disposition security headers when serving small files (up to 1 KiB) stored dir...
CVE-2026-96594 Gitea repository media API stored XSS
The Gitea API endpoint GET /api/v1/repos/owner/repo/media/filepath wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by...
CVE-2026-96594 Gitea repository media API stored XSS
The Gitea API endpoint GET /api/v1/repos/owner/repo/media/filepath wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by...
CVE-2026-105268 Gitea issue attachment API allows changing comment attachments
The Gitea API routes for issue attachments /api/v1/repos/owner/repo/issues/index/assets/attachmentid also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete...
CVE-2026-105268 Gitea issue attachment API allows changing comment attachments
The Gitea API routes for issue attachments /api/v1/repos/owner/repo/issues/index/assets/attachmentid also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete...
CVE-2026-105268
The Gitea application contains an authorization flaw in its issue attachment API routes (/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}). The vulnerability allows a user who opened an issue to rename or delete attachments that were actually posted in comments by other users. T...
charlotte
charlotte un lanceur de shellcode c++ totalement indétecté ; publié pour célébrer la naissance de mon nouveau-né description 13/05/2021: 1. lanceur de shellcode c++, totalement indétecté 0/26 en date du 13 mai 2021. 2. invocation dynamique des fonctions d'API win32 3. chiffrement XOR du shellcode...
CVE-2026-97208 Gitea push mirror API bypass of DISABLE_NEW_PUSH policy
The Gitea API endpoint for creating push mirrors POST /api/v1/repos/owner/repo/pushmirrors checked only whether mirroring was enabled and not the mirror DISABLENEWPUSH setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where th...
CVE-2026-97208 Gitea push mirror API bypass of DISABLE_NEW_PUSH policy
The Gitea API endpoint for creating push mirrors POST /api/v1/repos/owner/repo/pushmirrors checked only whether mirroring was enabled and not the mirror DISABLENEWPUSH setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where th...
CVE-2026-97208
The Gitea application contains a vulnerability in the push mirror creation API endpoint (POST /api/v1/repos/{owner}/{repo}/push_mirrors). The root cause is an incorrect authorization check where the API verifies if mirroring is enabled but fails to enforce the [mirror] DISABLE_NEW_PUSH setting re...
CVE-2026-97208 Gitea push mirror API bypass of DISABLE_NEW_PUSH policy
The Gitea API endpoint for creating push mirrors POST /api/v1/repos/owner/repo/pushmirrors checked only whether mirroring was enabled and not the mirror DISABLENEWPUSH setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where th...
CVE-2026-86684 Gitea push mirror local path check uses the repository owner
The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...
CVE-2026-86684 Gitea push mirror local path check uses the repository owner
The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...
CVE-2026-86684
An improper authorization check in the Gitea push mirror API allows an authenticated repository administrator to bypass local file system access restrictions. When the [security] IMPORT_LOCAL_PATHS = true setting is enabled, an administrator who lacks permission to import local paths can configur...
reportly
Reportly est un outil de rapport d'activité utilisateur EntraID. À propos de l'outil Cet outil aidera les équipes bleues lors d'un incident cloud. Lors de l'exécution de l'outil, le chercheur saisira en entrée un utilisateur suspect et une période de temps, et recevra un rapport détaillant les...
drltrace
Drltrace Build de test Windows Build de test Linux Drltrace est un traceur dynamique d'appels API pour les applications Windows et Linux. Drltrace est construit au-dessus du DynamoRIO, un framework d'instrumentation binaire dynamique. Drltrace a été initialement implémenté par Derek Bruening et...