1312280 matches found
Missing Authorization in get_deployed_stack Endpoint Allows Cross-Tenant Stack Enumeration via Server-Side Client Bypass
Description The GET /api/v1/stack-deployment/stack endpoint getdeployedstack is missing all RBAC authorization checks, while its sibling endpoint getstackdeploymentconfig in the same file has three verifypermission calls. This allows any authenticated user to enumerate all deployed stacks across...
curl: lib/http2.c: SSL connections accept non-HTTP push schemes (incomplete fix for 2e8c922a)
Summary: settransferurl in lib/http2.c validates the :scheme pseudo-header of PUSHPROMISE frames only when !viasslconn — a guard added by commit 2e8c922a to block non-TLS connections from accepting TLS-scheme pushes. The symmetric case was not addressed: over TLS, viasslconn is TRUE, the guard at...
Symlink Member Name Not Validated in filter_safe_tarinfos — Symlink Created Outside Extraction Directory
Description filtersafetarinfos in keras/src/utils/fileutils.py validates member names for regular files via ispathindir line 79, but for symlink entries it only validates the link target via islinkindir line 76 — the symlink's own info.name which determines where the symlink is created on disk is...
curl: libcurl stale CURLOPT_AUTOREFERER leaks a previous request URL to a different origin on a reused easy handle
Summary: libcurl keeps a stale data-state.referer after an HTTP redirect when CURLOPTAUTOREFERER is enabled. Curlhttpfollow stores the previous URL into data-state.referer at lib/http.c:1166-1189, and later requests reuse that value when building Referer: at lib/http.c:2954-2957. In my local...
Revive Adserver: Session ID reuse allowing XML‑RPC API authentication bypass
Vulnerability description not provided...
SSRF via Unvalidated URL in Artefact Import and Datastore Scrape (Incomplete CVE-2026-0560 Fix)
Description The fix for CVE-2026-0560 commit 76a54f0 added validateurl SSRF protection to backend/routers/files.py only. Two other endpoints that fetch user-supplied URLs have no SSRF protection and pass attacker-controlled URLs directly to ScrapeMaster: 1. POST...
curl: CVE-2026-6276: stale custom cookie host causes cookie leak
Summary: libcurl keeps a stale data-state.aptr.cookiehost after a request that uses a custom Host: header. On later requests on the same easy handle, when no custom Host: is used, libcurl still reuses that stale value for outgoing cookie selection lib/http.c:2560-2563 and incoming Set-Cookie...
CoinMate.io: HMAC signature verification omits endpoint and payload allowing request forgery on CoinMate API
A vulnerability was discovered in the HMAC signature verification process of the CoinMate API. The signature was calculated using only the nonce, client ID, and public key, omitting the HTTP endpoint and request payload. This allowed an attacker to hijack a valid signature intended for a read-onl...
curl: CVE-2026-6253: proxy credentials leak over redirect-to proxy
Summary: When libcurl follows a redirect and the new URL causes proxy re-selection, proxy credentials learned from the originally selected proxy URL can remain in per-transfer state and be reused for the next proxy. In the validated case, a redirect from http:// to https:// switches selection fro...
Revive Adserver: Stored XSS via Full Name field in userlog email entries
Vulnerability description not provided...
curl: Argument Injection via curl Short-Flag Grouping
This report details how the curl -os command facilitates an Argument Injection vulnerability in applications that wrap the curl command-line tool. The specific command curl -os /etc/passwd --url http://example.com demonstrates a subtle but dangerous behavior. Because -s silent follows -o output,...
curl: Negotiate Authentication Premature on Connection Reuse
Summary: Curl 8.19.0+ inappropriately sends Negotiate authentication headers on reused keep-alive connections where authentication was already completed. Commit ab650379a8 June 2025 moved negotiate auth context to on-demand metadata storage, but during connection reuse the metadata gets cleared...
curl: Integer Overflow/Signedness Mismatch in Printf Precision for HTTP/2 Trailer Headers
BUG IN https://raw.githubusercontent.com/curl/curl/07a9b89fedaec60bdbc254f23f66149b31d2f8da/lib/http2.c c ifstream-bodystarted / This is a trailer / H2BUGFinfofdatas, "h2 trailer: %.s: %.s", namelen, name, valuelen, value; result = Curldynaddf&stream-trailerrecvbuf, "%.s: %.s\r\n", namelen, name,...
Brave Software: Brave Shields Domain Reordering Leads to Origin Confusion
The Brave Shields feature was observed to reorder domain names, leading to potential origin confusion. Specifically, the domain "1.attacker.com" was displayed as "attacker.com.1", and "1.1.1.1.attacker.com" was displayed as "attacker.com.1.1.1.1". This behavior could potentially mislead users abo...
IBM: Reflected Cross-Site Scripting (XSS) found on IBM.com domain
A reflected Cross-Site Scripting XSS vulnerability was found on the IBM.com domain. The vulnerability was reported to IBM, analyzed, and remediated. The external researcher who reported the issue was acknowledged...
Node.js: HTTP/2 sessions never clean up after GOAWAY on invalid protocol errors
A flaw in the Node.js HTTP/2 server API was discovered that could cause servers to keep accepting data even after sending a GOAWAY frame. This vulnerability affected Node.js 22 and Node.js 24...
curl: libcurl: Integer truncation in curl_easy_ssls_import() causes TLS sessions to never expire
Summary: curleasysslsimport deserializes a TLS session blob and stores it in the in-memory session cache. In Curlsslsessionunpack lib/vtls/vtlsspack.c:311, the validuntil field is read as uint64t and cast directly to curlofft int64t with no bounds check — so a crafted blob encoding validuntil =...
Node.js: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching
Vulnerability description not provided...