2084 matches found
CVE-2026-82255
gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective U...
CVE-2026-82255
gitoxide versions from 0.25.4 contain an HTTP credential leak in the curl-based transport backend . The root cause is that credential validation checks the original URL rather than the effective URL after a redirect, allowing credentials to be sent to attacker-controlled destinations via cross-do...
CVE-2025-51471-POC
CVE-2025-51471 - PoC di esposizione del token cross-dominio di Ollama Autore: ajtazer 🔥 Panoramica Questo repository contiene un Proof of Concept PoC per CVE-2025-51471 , una vulnerabilità di esposizione del token di autenticazione cross-dominio che colpisce tutte le versioni di Ollama inclusa...
CVE-2025-61163
Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests...
AsyncHttpClient stores cookie for an unrelated domain (cookie tossing) via ThreadSafeCookieStore
Impact A cookie tossing / cookie injection issue CWE-1275. ThreadSafeCookieStore stored a cookie under the value of its Domain attribute without verifying that the responding host is allowed to set a cookie for that domain RFC 6265 §5.3 step 6. A host the client connects to can therefore plant a...
PT-2026-82359
In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with include subtree to the GET /v3/role assignments endpoint. The domain's project record has...
EUVD-2025-210786
Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests...
CVE-2025-61163
Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests...
CVE-2025-61163
Cohere North AI v1.1.5 contains an excessively permissive cross-domain policy with untrusted domains , caused by the server failing to validate the Origin header of incoming connection requests. This allows untrusted domains to interact with the service, rated CVSS 9.8 (Critical) with high impact...
CVE-2026-66722
Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack. A Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the call...
CVE-2026-66722 Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue
Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack. A Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the call...
EUVD-2026-63832
Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack. A Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the call...
USN-8655-1 async-http-client vulnerability
It was discovered that AsyncHttpClient did not properly verify that the responding host was allowed to set cookies for a given domain in its ThreadSafeCookieStore. An attacker could use this to plant cookies scoped to unrelated domains, which would then be sent on later requests to those domains...
USN-8632-1 node-follow-redirects vulnerability
Dennis Sepede discovered that follow-redirects did not properly remove custom authentication headers when following cross-domain redirects. An attacker could possibly use this issue to obtain sensitive authentication information, resulting in credential disclosure...
Permissive Cross-domain Policy with Untrusted Domains
Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the custom protocol handler when supportFetchAPI is enabled but...
Permissive Cross-domain Policy with Untrusted Domains
Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the custom protocol handler when supportFetchAPI ...
CVE-2026-18214
Summary of CVE-2026-18214 (Keycloak) Affected product: Keycloak with Google account login and domain-restriction configuration options. Vulnerable component/flow: token exchange feature that swaps a Google OAuth token for a Keycloak token. Root cause: the token exchange path does not enforce Goog...
CVE-2026-18214
Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check these domain restrictions. This mean...
Progress MOVEit Transfer < 2025.1.5 / 2026.0.x < 2026.0.3 Multiple Vulnerabilities (July 2026)
The version of Progress MOVEit Transfer installed on the remote host is prior to 2025.1.5 or 2026.0.x prior to 2026.0.3. It is, therefore, affected by multiple vulnerabilities: - Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. CVE-2026-159...