1312280 matches found
curl: curl_easy_header runs at O(N) or worse and can be abused to use minute(s) of CPU time
Summary: The implementation of curleasyheader can be abused by a malicious server that puts all headers under a single key. Imagine a server response like: HTTP/1.1 200 OK a: a: a: a: repeat until MAXHTTPRESPHEADERSIZE bytes are used As a developer, if you want to loop through the headers you do...
Node.js: HashDoS in V8
The V8 release used in Node.js v24.0.0 changed how string hashes were computed using rapidhash. This implementation reintroduced the HashDoS vulnerability, where an attacker who could control the strings to be hashed could generate many hash collisions without knowing the hash-seed...
Informatica: EXIF metadata not stripped from profile image
The EXIF metadata was not stripped from the profile images uploaded to the platform. This could have resulted in the disclosure of location or other personal information associated with the uploaded images...
U.S. Dept Of Defense: SQL Injection via URL
A SQL injection vulnerability was discovered in the website's URL. The vulnerability allowed manipulation of SQL queries executed by the backend database. The vulnerability was demonstrated by changing the sleep value, which resulted in longer or shorter delays in the page loading...
U.S. Dept Of Defense: SQL Injection - entryid parameter in 'formbuilderv2-confirmation.php'
A SQL injection vulnerability was discovered in the 'entryid' parameter of the 'formbuilderv2-confirmation.php' script on the website. The vulnerability allowed for the manipulation of SQL queries executed by the backend database...
U.S. Dept Of Defense: POST XSS - fields[account][lastname] parameter
A cross-site scripting XSS vulnerability was discovered in the fieldsaccountlastname parameter of the POST request. The vulnerability allowed an attacker to inject malicious scripts that could be executed. This could potentially lead to consequences such as cookie theft and session hijacking...
U.S. Dept Of Defense: POST XSS - fields[account][firstname] parameter
A cross-site scripting XSS vulnerability was discovered in a parameter named "fieldsaccountfirstname" that was processed via the POST method. The vulnerability allowed the injection of malicious scripts that could be executed when the affected page was loaded. The impact of the vulnerability was...
U.S. Dept Of Defense: POST XSS - data[type] parameter
A Cross-Site Scripting XSS vulnerability was discovered on a certain system. The vulnerable parameter was datatype, which allowed an attacker to inject malicious scripts that could be executed. The vulnerability was reported and referenced...
U.S. Dept Of Defense: SQL Injection - data[account][id] parameter
A SQL injection vulnerability was discovered in the "dataaccountid" parameter on the website. The vulnerability allowed for the manipulation of SQL queries executed by the backend database. The impact of this vulnerability was not specified...
U.S. Dept Of Defense: POST XSS - data[account][id] parameter
A Cross-Site Scripting XSS vulnerability was discovered in the POST method through the "dataaccountid" parameter. The vulnerability allowed the injection of malicious scripts that could be executed. The affected system was located on a system host. The vulnerability was not assigned a CVE number...
Mars: RXSS on ββββββ via customerId parameter
A Reflected Cross-Site Scripting XSS vulnerability was identified on the Mars website at ββββββ. The vulnerability was located in the customerId parameter, which was inadequately sanitized before being reflected back to users in the HTTP response. When the parameter was manipulated with malicious...
curl: HTTP/3 Stream Dependency Cycle Exploit
Penetration Testing Report: HTTP/3 Stream Dependency Cycle Exploit --- 0x00 Overview A novel exploit leveraging stream dependency cycles in the HTTP/3 protocol stack was discovered, resulting in memory corruption and potential denial-of-service or remote code execution scenarios when used against...
curl: HTTP/2 CONTINUATION Flood Vulnerability
0x00 Vulnerability Overview: Fatal Flaw in HTTP/2 Protocol Stack 1. HTTP/2 Header Block Fragmentation Mechanism RFC 7540 Specification: Header blocks are transmitted using a HEADERS frame followed by one or more CONTINUATION frames. All frames must belong to the same stream and be sent...
GitHub: Arbitrary Read of Another Users private repository without Authorization
An improper access control vulnerability was identified in GitHub Enterprise Server that allowed users with access to any repository to retrieve limited code content from another repository by creating a diff between the repositories. This vulnerability affected all versions of GitHub Enterprise...
curl: Speculative Execution Side-Channel in `curl`
π‘οΈ Penetration Testing Report ========== Speculative Execution Side-Channel in curl Date: May 2025 --- π§ Executive Summary This report outlines a speculative execution side-channel vulnerability found in curl versions 7.12.0 to 8.9.0, specifically within builds supporting experimental QUIC...
U.S. Dept Of Defense: Swagger UI Injection via Config URL - `βββ`
A Swagger UI injection vulnerability was identified on a specific endpoint. The issue allowed an attacker to inject custom JSON configuration into the Swagger UI, potentially leading to unspecified consequences...
Fastify: Remote Code Execution via unsafe usage of `reply.view({ raw })` in @fastify/view (EJS template engine)
The @fastify/view plugin, when used with the EJS engine and the reply.view raw: pattern, allowed arbitrary EJS execution. This vulnerability arose from the fact that Fastify trusted the raw template string without sanitization or restrictions when passed directly to EJS's compile method, leading ...
Regular expression Denial of Service - ReDoS
Description A regular expression denial of service ReDoS vulnerability has been identified in the Hugging Face Transformers library's weight conversion utility. The vulnerability exists in the converttfweightnametoptweightname function, which converts TensorFlow weight names to PyTorch format. Th...
curl: [High] Arbitrary File Write via Path Traversal in cURL CLI (`-o`, `--output`) (CWE-22: Improper Limitation of a Pathname to a Restricted Directory)
Summary: The -o / --output parameter in cURL does not restrict or sanitize file paths. When passed relative traversal sequences e.g., ../../, cURL writes files outside the current working directory, allowing arbitrary file overwrite. In automated or privileged environments CI/CD, root containers,...
curl: [High] MITM via Insecure CA Path Handling in cURL (--capath, CURLOPT_CAPATH) (CWE-494: Download of Code Without Integrity Check)
Summary: The --capath option in cURL and CURLOPTCAPATH in libcurl accept any directory path without validation. If an attacker provides a custom CA path containing a fake root certificate, cURL will trust malicious HTTPS endpoints signed with that fake root. This allows for full Man-in-the-Middle...