CVE-2020-15392

CVE-2020-15392 Énumération d'utilisateurs sur Supravizio BPM 10.1.2 Description Une faille de vulnérabilité d'énumération d'utilisateurs a été découverte dans Supravizio BPM, version 10.1.2. Ce problème se produit lors de la récupération du mot de passe, où une différence dans les messages pourra...

CVE-2024-29296

CVE-2024-29296 - Перечисление пользователей в Portainer CE - 2.19.4 Уязвимость перечисления пользователей была обнаружена в Portainer CE 2.19.4. Эта проблема возникает в процессе аутентификации пользователей, когда разница во времени ответа может позволить удаленному неаутентифицированному...

cve-2018-15473

CVE-2018-15473 OpenSSH jusqu'à la version 7.7 est vulnérable à une énumération d'utilisateurs en raison du fait qu'il ne retarde pas l'abandon pour un utilisateur d'authentification invalide jusqu'à ce que le paquet contenant la demande ait été entièrement analysé, lié à auth2-gss.c,...

CVE-2025-8471

CVE-2025-8471 SQL Injection PoC Auteur : Byte Reaper CVE : CVE-2025-8471 Vulnérabilité : Injection SQL dans « projectworlds Online Admission System v1.0 » Description : Une injection SQL aveugle existe dans adminlogin.php?aid=. Ce PoC envoie une série de requêtes GET avec diverses charges utiles ...

Dropbear_CVE-2013-4434

DropbearCVE-2013-4434 dropbearCVE-2013-4434.sh Ce script vérifie CVE-2013-4434 https://vulners.com/cve/CVE-2013-4434. Le serveur SSH Dropbear antérieur à 2013.59 génère des messages d'erreur pour une tentative de connexion échouée avec des délais différents selon que le compte utilisateur existe ...

Telerik UI for ASP.NET AJAX 2010.1.309 < 2026.2.708 Multiple RadAsyncUpload Vulnerabilities

The version of Progress Telerik UI for ASP.NET AJAX installed on the remote Windows host is 2010.1.309 or later and prior to 2026.2.708. It is, therefore, affected by multiple vulnerabilities: - In Progress Telerik UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can...

PT-2026-96163

Name of the Vulnerable Software and Affected Versions Tinyauth versions prior to 5.1.0 Description Tinyauth exposes a timing difference during authentication attempts that allows a remote observer to distinguish between existing and nonexistent local usernames. This occurs because the loginHandle...

Astra Linux – Vulnerability in u-boot

Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur due to a crafted squashfs filesystem using sbrk, request2size, or because ptrdifft is mishandled on x8664...

Astra Linux – Vulnerability in Containerd

In containerd a industry-standard container runtime, before versions 1.3.10 and 1.4.4, containers launched through containerd’s CRI implementation via Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service that share the same image might receive incorrect...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: rcu: A buffer overflow has been fixed in printcpustallinfo. The output from printcpustallinfo may cause a buffer overflow if there is a significant difference in “jiffies”. This might seem unlikely, but computers sometimes get ti...

CVE-2026-89173

The Smart Video Intercom System developed by Kingdom Communication Associated is affected by a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses, allowing them to discover which accounts exist on...

CVE-2026-87623

Observable discrepancy in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79242

Observable discrepancy in HTML in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

PT-2026-79441

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has been fixed in version 3.2.3...

EUVD-2026-53367

ChirpStack's SQLite-backend device tag filtering chirpstack/src/storage/device.rs, in both getcount and list interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format! macro dsl::sql::&format!"device.tags-'' =", k.bind::v, while only the tag VALUE is safely...

GHSA-MWP4-54F8-5FHR ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

Summary Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inetaton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4'012.0.0.1'...

fast-uri vulnerable to host confusion via backslash authority introducer

Impact fast-uri v4.1.1 and earlier require a literal // to recognize a URI authority, so a reference that uses \, /, or / as the authority introducer in place of //, after an optional scheme is parsed with no authority: the sequence and everything after it fold into the path. Node's native...

GHSA-7P8R-X3MC-P8W7 fast-uri vulnerable to host confusion via backslash authority introducer

Impact fast-uri v4.1.1 and earlier require a literal // to recognize a URI authority, so a reference that uses \, /, or / as the authority introducer in place of //, after an optional scheme is parsed with no authority: the sequence and everything after it fold into the path. Node's native...

SUSE CVE-2026-67201

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery SSRF bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authori...

CVE-2026-67201

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery SSRF bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authori...