68 matches found
CVE-2026-68558 Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)
Wekan is open source kanban built with Meteor. From 8.36 until 9.74, the outgoing webhook Integration URL validator in models/integrations.js checked only the literal URL.hostname against regular expressions, so DNS names such as 169-254-169-254.nip.io passed that first-line check. The delivery...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration. An attacker can access internal network resources by supplying a specially crafted DNS hostname that resolves to both allowed and blocked IP addresses, causing the validation...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration. An attacker can access internal network resources by supplying a specially crafted DNS hostname that resolves to both allowed and blocked IP addresses, causing the validation...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration. An attacker can access internal network resources by supplying a specially crafted DNS hostname that resolves to both allowed and blocked IP addresses, causing the validation...
RockyLinux 9 : glibc (RLSA-2026:20597)
The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:20597 advisory. glibc: glibc: Incorrect DNS response parsing via crafted DNS server response CVE-2026-4437 glibc: glibc: Invalid DNS hostname returned via gethostbyaddr...
RockyLinux 10 : glibc (RLSA-2026:19061)
The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:19061 advisory. glibc: glibc: Incorrect DNS response parsing via crafted DNS server response CVE-2026-4437 glibc: glibc: Invalid DNS hostname returned via gethostbyadd...
Linux Distros Unpatched Vulnerability : CVE-2026-4438
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Calling gethostbyaddr or gethostbyaddrr with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2....
CVE-2020-10212
upload.php in Responsive FileManager 9.13.4 and 9.14.0 allows SSRF via the url parameter because file-extension blocking is mishandled and because it is possible for a DNS hostname to resolve to an internal IP address. For example, an SSRF attempt may succeed if a .ico filename is added to the...
EUVD-2015-1410
Malware in sbrugna...
EUVD-2006-1257
Malware in sbrugna...
EUVD-2013-7070
Malware in sbrugna...
EUVD-2000-1053
Malware in sbrugna...
EUVD-1999-1302
Malware in sbrugna...
EUVD-2010-1616
Malware in sbrugna...
EUVD-2002-2240
Malware in sbrugna...
EUVD-2022-43780
Malicious code in bioql PyPI...
CVE-2010-1590
Cross-site scripting XSS vulnerability in shopsessionsubs.asp in Rocksalt International VP-ASP Shopping Cart 6.50 and earlier might allow remote attackers to inject arbitrary web script or HTML via the client's DNS hostname aka the REMOTEHOST variable, related to the CookielessGenerateFilename an...
CVE-2022-40505
Information disclosure due to buffer over-read in Modem while parsing DNS hostname...
