CVE-2019-5420

CVE-2019-5420 Эксплойт для Rails CVE-2019-5420 Проблема До Rails v5.2.2 при защите сессий в режиме разработки приложение извлекает ключ из названия приложения...

CVE-2019-5420

CVE-2019-5420 Уязвимость может позволить злоумышленнику угадать автоматически сгенерированный секретный токен режима разработки. Ruby-on-Rails при работе в режиме разработки. В режиме разработки злоумышленник может угадать ключ, используемый для защиты сессий. Расшифровка: Генерация ключа: Rails...

CVE-2019-5420

CVE-2019-5420 Ruby-on-Rails предлагает три различные среды, в которых он может работать: разработка, тестирование и продакшен. Разумеется, код, работающий в среде разработки или тестирования, не должен быть доступен в интернете, но как всегда это происходит например, в staging-средах. Ruby-on-Rai...

Apache-Struts-2-CVE-2017-5638-Exploit-

Apache-Struts-2-CVE-2017-5638-Exploit Cet exploit exploite la vulnérabilité Apache Struts2 CVE-2017-5638, permettant d'exécuter des commandes à distance sur le serveur Apache. Comment utiliser : $ sudo python Struts2Shell001.py ! Exploit Apache Struts2 DEMO Code de Rvbk + HOST con https Site avec...

CVE-2019-5420

CVE-2019-5420 PoC Уязвимость удаленного выполнения кода в режиме разработки Rails 5.2.2.1, 6.0.0.beta3 может позволить злоумышленнику угадать автоматически сгенерированный секретный токен режима разработки. Этот секретный токен может быть использован в сочетании с другими внутренними механизмами...

Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host

Impact Nuxt DevTools development mode only exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint ws://:/, subprotocol vite-hmr can call RPC methods,...

PYSEC-2026-3515 PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default

Summary The published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint: text praisonai serve...

PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default

Summary The published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint: text praisonai serve...

CVE-2026-22599

Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated administrator could inject arbitrary...

CVE-2026-22599

Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated administrator could inject arbitrary...

CVE-2026-22599 Strapi Vulnerable to SQL Injection in Content Type Builder

Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated administrator could inject arbitrary...

CVE-2026-22599 Strapi Vulnerable to SQL Injection in Content Type Builder

Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated administrator could inject arbitrary...

CVE-2026-22599

Strapi Content-Type Builder contains a database-query injection in the write API for the 4.x and 5.x branches prior to 4.26.1 and 5.33.2. An authenticated administrator could pass arbitrary SQL via column.defaultTo (as [value, { isRaw: true }]) to Knex during schema migrations, enabling statement...

EUVD-2026-30352

Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated administrator could inject arbitrary...

SQL Injection

Overview @strapi/plugin-content-type-builder is a Strapi plugin to create content type Affected versions of this package are vulnerable to SQL Injection via the column.defaultTo attribute in the content type creation or modification. An attacker can execute arbitrary database statements by...

Linux Distros Unpatched Vulnerability : CVE-2026-33167

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does no...

SUSE CVE-2026-33167

Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page,...

CVE-2026-33167

Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page,...

UBUNTU-CVE-2026-33167

Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page,...

CVE-2026-33167

Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page,...