OpenAM<=15.0.3 FreeMarker - Template Injection

OpenAM is an open access management solution. In versions 15.0.3 and prior, the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input id: CVE-2024-41667 info: name: OpenAM=15.0.3 FreeMarker - Template Injection...

Astra Linux – Vulnerability in dovecot

The ManageSieve AUTHENTICATE command crashes when using “literal” as the initial response to SASL. This can be used to repeatedly crash the ManageSieve service, rendering it unavailable to other users. It’s recommended to control access to the ManageSieve port or disable the service if it’s not...

TOTPAuthenticate

TOTP Authenticate ============================ 使用会话处理规则将 TOTP 令牌添加到传出请求中。 适用于 Burp Suite Enterprise Edition 请注意，扩展由 Burp 的第三方用户编写，PortSwigger 不对其质量或对任何特定用途的适用性提供任何保证。 用法 1. 构建扩展 2. 将扩展加载到 Burp Enterprise，并将其添加到您的“站点详细信息”页面 3. 在 Burp Suite Professional 中配置您的会话处理规则 4. 将扫描配置导入...

CVE-2025-51471-POC

CVE-2025-51471 - Ollama 跨域令牌泄露 PoC 作者： ajtazer 🔥 概述 此仓库包含 CVE-2025-51471 的概念验证（PoC），这是一个影响 所有 Ollama 版本 （包括最新版本）的跨域认证令牌泄露漏洞。 📋 漏洞描述 当 Ollama 从返回 401 Unauthorized 的 HTTPS 服务器拉取模型时，它会跟随 WWW-Authenticate 头中的 realm URL，而 不验证其是否属于同一域... 这允许攻击者： 1. 搭建一个恶意的“registry”服务器 2. 诱骗用户从该服务器拉取模型 3...

CVE-2026-82756

Improper Encoding or Escaping of Output vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resourcemetadata="..."...

CVE-2026-82756

ash_authentication_oauth2_server (ash-project) is vulnerable to header parameter injection in its BearerPlug and RequireScopePlug. A tenant-derived resource_metadata URL is interpolated directly into the WWW-Authenticate challenge without escaping, allowing an unauthenticated attacker in a multi-...

EEF-CVE-2026-82756 ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection

Summary Improper Encoding or Escaping of Output vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer...

CVE-2026-82756 ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection

Improper Encoding or Escaping of Output vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resourcemetadata="..."...

EUVD-2026-72538

Improper Encoding or Escaping of Output vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resourcemetadata="..."...

Astra Linux – Vulnerability in imagemagick

ImageMagick versions before 6.9.11-40 and 7.x before 7.0.10-40 mishandle the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized, allowing additional shell commands to be injected through...

EUVD-2026-63172

A vulnerability was found in chenhg5 cc-connect up to 1.4.1. Affected by this vulnerability is the function Authenticate of the file core/webhook.go. The manipulation of the argument exec results in code injection. The attack may be performed from remote. The exploit has been made public and coul...

CVE-2026-76760 chenhg5 cc-connect webhook.go authenticate code injection

A vulnerability was found in chenhg5 cc-connect up to 1.4.1. Affected by this vulnerability is the function Authenticate of the file core/webhook.go. The manipulation of the argument exec results in code injection. The attack may be performed from remote. The exploit has been made public and coul...

CVE-2026-76760 chenhg5 cc-connect webhook.go authenticate code injection

A vulnerability was found in chenhg5 cc-connect up to 1.4.1. Affected by this vulnerability is the function Authenticate of the file core/webhook.go. The manipulation of the argument exec results in code injection. The attack may be performed from remote. The exploit has been made public and coul...

CVE-2026-76760

In chenhg5 cc-connect up to version 1.4.1, the Authenticate function in core/webhook.go injects the attacker-controlled exec argument directly into command execution, enabling unauthenticated remote code injection over the network. CVSS 3.1 rates this HIGH (7.3). No patch version or exploit detai...

CVE-2026-75114 Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64

Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate in Zoo 4.1.64 - The referer request parameter is passed straight to setRedirect with no validation...

CVE-2026-16742

systemd-homed (CVE-2026-16742) contains a local privilege escalation flaw. The CVE entry describes an ability to add arbitrary system groups to a locally logged-in, homed-managed user, enabling elevation of privileges. The CVELIST record refines the root cause as missing home-record signature ver...

CVE-2026-16742

systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user...

CVE-2026-50630

A flaw was found in apache-cxf. This vulnerability, known as a Carriage Return Line Feed CRLF injection, allows an attacker to manipulate HTTP response headers. By injecting special characters into the 'realm' parameter of the WWW-Authenticate header, an attacker can add arbitrary HTTP headers or...

Next.js: Unauthenticated disclosure of internal Server Function endpoints

Impact In Next.js applications using App Router, Server Actions use server or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts for...

PYSEC-2026-2391 BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing

The dockerpull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validation. An attacker in a man-in-the-middle position between bbot and a Docker registry could modify this header to redirect the authentication reques...