CVE-2026-21010-VoIP-SIP-Digest-Authentication-Replay

CVE-2026-21010 – إعادة إرسال مصادقة Digest في SIP/VoIP كود البرنامج محاكي SIP بلغة Python root@kitploit: sipserversim.py - SIP server that accepts replayed authenticated requests from flask import Flask, request app = Flaskname Simulated nonce storage: doesn't track used nonces usednonces = set...

PoC_CVE-2019-0217

Questo repository contiene un exploit proof of concept per CVE-2019-0217, insieme a un Dockerfile per configurare un server web vulnerabile alla CVE. Descrizione della CVE In Apache HTTP Server 2.4 release 2.4.38 e precedenti, una condizione di gara in modauthdigest quando viene eseguito in un...

CTT-enhanced-Apache-mod_auth_digest-timing-attack-exploit

Attacco di Timing CTT-Enhanced Apache modauthdigest — CVE-2026-33006 Attacco di Timing CTT-Enhanced Apache modauthdigest — CVE-2026-33006 Bypass dell'Autenticazione Digest Remota → Attacco di Timing Temporale a 33 Livelli Vulnerabilità originale: Apache HTTP Server 2.4.66 perdita di timing...

cve-2026-43512-poc

CVE-2026-43512 — Bypass de Autenticação DIGEST do Apache Tomcat Resultado da análise de explorabilidade: a causa raiz está confirmada. A exploração de ponta a ponta não é reproduzível contra uma implantação padrão do UserDatabaseRealm. Veja Análise para detalhes. Índice Visão Geral Versões Afetad...

Astra Linux – Vulnerability in Tomcat9

DEPRECATED: There is a vulnerability related to authentication bypass in digest authentication in Apache Tomcat. This issue affects Apache Tomcat versions as follows: 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, 9.0.0.M1 through 9.0.117, 8.5.0 through 8.5.100, and versions prior to 7.0.0...

CVE-2026-62698

Numeric truncation error in Microsoft Digest Authentication allows an authorized attacker to elevate privileges locally...

CVE-2026-62698

The CVE-2026-62698 entry concerns a numeric truncation error in Microsoft Digest Authentication. The vulnerability is described as enabling a locally authenticated attacker to achieve privilege elevation (base score 7.8, CVSS 3.1, LOCAL, LOW privileges required, NONE user interaction, HIGH impact...

EUVD-2026-56628

Numeric truncation error in Microsoft Digest Authentication allows an authorized attacker to elevate privileges locally...

CVE-2026-62698 Microsoft Digest Authentication Elevation of Privilege Vulnerability

...

CVE-2026-62698 Microsoft Digest Authentication Elevation of Privilege Vulnerability

...

Microsoft Digest Authentication Elevation of Privilege Vulnerability

Numeric truncation error in Microsoft Digest Authentication allows an authorized attacker to elevate privileges locally...

PT-2026-70463

Name of the Vulnerable Software and Affected Versions Microsoft Digest Authentication affected versions not specified Description A numeric truncation error in Microsoft Digest Authentication allows an authorized attacker to elevate privileges locally. This issue enables attackers to gain...

EulerOS 2.0 SP11 : curl (EulerOS-SA-2026-3063)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When asked to both use a .netrc file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the...

JLSEC-2026-1210 Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest**...

Successfully using libcurl to do a transfer over a specific HTTP proxy proxyA with Digest authentication and then changing the proxy host to a second one proxyB for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Proxy-Authorization: header field meant for proxyA, to...

JLSEC-2026-1216 When reusing a libcurl handle for sequential transfers driven by environment-variable proxy...

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed...

JLSEC-2026-1201 Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest**...

Successfully using libcurl to do a transfer to a specific HTTP origin hostA with Digest authentication and then changing the origin to a different one hostB for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB...

GHSA-X677-9FXG-V5C5 Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth

Summary There is a high severity vulnerability in Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares. The fix for CVE-2026-33433 stripped canonical-cased spoofed identity headers e.g. X-Auth-User before writing Traefik's own value, but did not account for underscore-variant header names...

CVE-2026-10050

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains...

CVE-2026-10050 Digest authentication lossy encoding

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains...

CVE-2026-10050

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains...