3755 matches found
Open WebUI 路径遍历漏洞
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted WebUI that is open source. Versions of Open WebUI prior to 0.1.124 contained a path traversal vulnerability. This vulnerability occurred when files were attached in messages, where the file names originated from the original...
curl: Trailing-dot IPv4 URL bypasses IP-address guard, allows wildcard DNS SAN match
Hi all, Sorry to ruin anybody's day, but we've discovered another issue when it comes to dots. We've found a TLS certificate verification bypass that lets a trailing-dot IPv4 URL -- https://127.0.0.1./ -- pass peer authentication against a wildcard DNS SAN certificate such as DNS:.0.0.1. The IP...
VulnCheck KEV: CVE-2026-28517
openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in reportnetworkmap.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec without validation or sanitization. If an attacker can modify the...
curl: HSTS multi-trailing-dot bypass-ish: possible incomplete fix for CVE-2022-30115
Hi all, Honestly, I'm not completely certain about this issue, but I think the CVE-2022-30115 fix "HSTS bypass via trailing dot" is incomplete: the same asymmetry exists for hostnames with two or more trailing dots, so http://example.com../ still gets sent in plaintext when there's a valid HSTS...
curl: CVE-2026-8924: trailing dot domain super cookie
Summary: A PSL-enabled curl build rejects a canonical public suffix cookie such as Domain=co.uk, but accepts the trailing-dot variant Domain=co.uk. when the request host also uses a trailing dot. In the reproduced case, a response from foo.co.uk. sets Set-Cookie: trail=1; Domain=co.uk.; Path=/, a...
The vulnerability of the .NET software platform, related to insufficient validation of output data, allows attackers to increase their privileges.
The vulnerability of the .NET software platform is related to insufficient validation of output data. Exploiting this vulnerability can allow attackers to enhance their privileges...
protobuf.js 代码注入漏洞
protobuf.js is an open-source implementation of the Protocol Buffers protocol, written entirely in JavaScript. It supports Node.js and browsers with TypeScript. It’s easy to use, extremely fast, and can be used out of the box through.proto files. Versions prior to 7.5.6 and 8.0.2 of protobuf.js h...
PT-2026-40763
Name of the Vulnerable Software and Affected Versions cowboy versions 2.0.0 through 2.14.x Description An issue in multipart header parsing allows an unauthenticated attacker to cause a denial of service via unbounded buffer accumulation. The function read part in src/cowboy req.erl accumulates...
CKAN 跨站请求伪造漏洞
CKAN is an open-source data management system developed by CKAN contributors. It is used to power data centers and data portals. Versions of CKAN prior to 2.10.10 and 2.11.5 contained a cross-site request forgeing vulnerability. This vulnerability stemmed from allowing endpoints to be marked as n...
GHSA-886Q-F44J-H6WH SillyTavern has a Path Traversal issue
Summary POST /api/extensions/delete endpoint accepts extensionName: "." which bypasses sanitize-filename validation, causing the entire user extensions directory to be recursively deleted. No authentication is required in the default configuration. Affected File src/endpoints/extensions.js last...
2026-05 .NET 8.0.27 Security Update for x64 Server (KB5093447)
2026-05 .NET 8.0.27 Security Update for x64 Server KB5093447...
2026-05 .NET 9.0.16 Security Update for x64 Client (KB5093448)
2026-05 .NET 9.0.16 Security Update for x64 Client KB5093448...
2026-05 Security and Quality Rollup for .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012 R2 for x64 (KB5088861)
2026-05 Security and Quality Rollup for .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012 R2 for x64 KB5088861...
CVE-2026-35433
CVE-2026-35433 involves improper input validation in .NET Framework that enables local Elevation of Privilege. Public details in connected documents indicate the vulnerability affects multiple .NET Framework versions and is being addressed via May 12, 2026 security updates (e.g., KB5087058/KB5087...
CVE-2026-35433 .NET Elevation of Privilege Vulnerability
...
CVE-2026-32177
Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally...
PT-2026-40444
Name of the Vulnerable Software and Affected Versions efw4.X versions prior to 4.08.010 Description The elfinder checkRisk function validates target and targets for path traversal and home containment but fails to validate the dst parameter used by elfinder paste. This allows an attacker to copy ...
Microsoft .NET 输入验证错误漏洞
Microsoft .NET is a software framework developed by Microsoft Corporation in the United States. It focuses on agile software development, rapid application development, platform independence, and transparency in networking. There is an input validation vulnerability in Microsoft .NET. Attackers c...
Microsoft .NET 安全漏洞
Microsoft .NET is a software framework developed by Microsoft Corporation in the United States. It focuses on agile software development, rapid application development, platform independence, and network transparency. There are security vulnerabilities in Microsoft .NET. Attackers can exploit the...
