655 matches found
CVE-2024-25175
CVE-2024-25175 通过HTTP响应拆分实现的反射型XSS 描述 : 利用此漏洞可导致受害者在点击特制链接时，其浏览器中执行JavaScript代码（跨站脚本）。漏洞产生的原因是Web服务器未能正确处理换行符（\r\n 或 CR\LF，URL编码中为 %0d%0a）。 影响 : 反射型XSS CVSSv3.1 向量 : AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N 6.1 CWE : CWE-20: 输入验证不当 受影响的组件 : GET参数 kickidlerauthenticationtoken 供应商 : Kickidler: 员工监控软件...
openclaw-hardening-check
このスクリプトは読み取りのみを行います。何も修正せず、安全であることを保証するものではありません。緑色の出力は、以下にリストされたチェックが合格したことのみを意味します。それ以上の意味はありません。 OpenClaw ハードニングチェック openclaw-hardening-check.mjs は、依存関係のない小さなオフラインスクリプトで、OpenClaw インストールのレビューを行います。ローカル設定、パッケージメタデータ、プラグインとスキルのマニフェスト、ファイルモード、そしてLinuxでは実行中のGatewayの /proc...
CVE-2026-82255
gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective U...
EUVD-2026-67581
gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective U...
EUVD-2026-67283
An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session informati...
CVE-2026-76179
An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session informati...
CVE-2026-79782
rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS session tokens sent in request headers...
Astra Linux – Vulnerability in Firefox
The “Copy Image Link” context menu action would copy the final image URL after redirects. By embedding an image that triggered authentication flows—in conjunction with a Content Security Policy that stopped a redirection chain in the middle—the final image URL could contain an authentication toke...
CVE-2026-76389
In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, a user that holds a role with the gettalosenrichment capability could send a crafted request to the Talos intelligence enrichment Representational State Transfer REST API endpoint and cause the instance to make an...
CVE-2026-75915
CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the jsexecution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API key...
CVE-2026-75915 CodeWhale before 0.8.64 Environment Variable Leak via js_execution
CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the jsexecution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API key...
CVE-2026-75010
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver...
CVE-2026-75010
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver...
CVE-2026-75010
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver...
CVE-2026-75010
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the password plugin's modoboa driver can leak a Modoboa API authentication token to a user-controlled host via crafted session data, affecting only instances using that driver. CVSS 3.1 score is 6.4 (Medium). Patches are available in 1.6....
CVE-2026-75010
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver...
CVE-2026-75010
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver...
CVE-2026-46405
A flaw was found in OpenBao, an identity-based secrets management system. When the Kerberos authentication method processes a GET request or an Authorization: Negotiate header, it inadvertently creates authentication tokens that are not accessible to the caller and are hidden by an error message...