137 matches found
CVE-2023-23752
CVE-2023-23752 CVE-2023-23752 Data Extractor Build git clone https://github.com/JohnDoeAnonITA/CVE-2023-23752 cd CVE-2023-23752 go build . Usage CVE-2023-23752.exe -h|--help -u|--url "" -t|--type 1|2 Help / / / | // //// // //.'///'/ // //// / CVE-2023-23752 Data Extractor v0.1 Arguments: -h --he...
Apache Solr <= 7.1 - XML Entity Injection
Apache Solr with Apache Lucene before 7.1 is susceptible to remote code execution by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external...
Apache Solr - Deserialization of Untrusted Data
In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side. id:...
CVE-2026-69194 FileRise: Unsanitized footerHtml in Public Site Config
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.21.0, FileRise returns the stored branding.footerHtml value through the unauthenticated public site configuration API without server-side sanitization. The FileRise frontend already...
PT-2026-114254
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.21.0, FileRise returns the stored branding.footerHtml value through the unauthenticated public site configuration API without server-side sanitization. The FileRise frontend already...
CLEANSTART-2026-XI09971 Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET...
Security vulnerability affects the airflow-3 package. The Config API in Apache Airflow surfaced per-key secrets-backend overrides environment variables like AIRFLOWSECRETSBACKENDKWARGSECRETID and AIRFLOWWORKERSSECRETSBACKENDKWARGSECRETID as synthetic config options whose option names were not in...
PT-2026-117907
Security vulnerability affects the airflow-3 package. The Config API in Apache Airflow surfaced per-key secrets-backend overrides environment variables like AIRFLOW SECRETS BACKEND KWARG SECRET ID and AIRFLOW WORKERS SECRETS BACKEND KWARG SECRET ID as synthetic config options whose option names...
Exploit for Improper Restriction of XML External Entity Reference in Apache Solr
Apache Solr RunExecutableListener RCE CVE-2017-12629 Vulhu...
Exploit for Injection in Apache Solr
Apache Solr Velocity Template RCE CVE-2019-17558 Vulhubh...
CVE-2026-52740
GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline...
CVE-2026-52740 GoCD is vulnerable to pipeline template view API authorization bypass
GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline...
EUVD-2026-83951
GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline...
CVE-2026-52740 GoCD is vulnerable to pipeline template view API authorization bypass
GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline...
CVE-2026-52740: Incorrect Authorization
GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline...
PT-2026-96130
Name of the Vulnerable Software and Affected Versions GoCD versions 18.7.0 through 26.0.x Description The Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. This allows an authenticated user with low privileges to bypass view permission...
CVE-2026-77170
The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board...
CVE-2026-77170
The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board...
CVE-2026-77170
CVE-2026-77170 affects the Deck config API , where an insufficient authorization check allows any authenticated user to set board-scoped configuration keys for arbitrary board IDs without verifying ownership or management permission over the referenced board. The impact is rated MEDIUM (CVSS 3.0:...
CVE-2026-77170
The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board...
EUVD-2026-82620
The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board...