15516 matches found
Webmin < 1.920 - Authenticated Remote Code Execution
rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialisevariable makes an eval call. NOTE: the WebminServersIndex documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must...
CLEANSTART-2026-LB53139 undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header
CVE-2026-84890 affects multiple packages. undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. See references for individual vulnerability details...
CLEANSTART-2026-ZX09100 Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding
Security vulnerability affects the apache-nifi-registry package. Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding...
CLEANSTART-2026-AF46685 In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes
CVE-2026-10050 affects multiple packages. In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. See references for individual vulnerability details...
PT-2026-107785
An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication FA, the system fails to sanitize the Identity Provider IdP issuer parameter. An authenticated administrator—or an...
Security Bulletin: EDB PGAI Hybrid Management with IBM is affected by Multiple Vulnerabilities.
Summary Multiple Vulnerabilities found in EDB PGAI products - 1 EDB PGAI AI Factory with IBM 1.3.0, 2 EDB PGAI Analytics Accelerator 1.3.0, and 3 EDB PGAI Hybrid Data Management 1.3.0. The vulnerabilities have been addressed in 1.4.1 version. Hence, IBM strongly recommends upgrading to 1.4.1...
Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in Apache Log4j
Summary The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in Apache Log4j. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during...
CVE-2024-21762
CVE-2024-21762 - أداة كشف واستغلال FortiGate SSL VPN RCE أداة كشف واستغلال لـ CVE-2024-21762 - ثغرة حرجة في FortiGate SSL VPN ⚠️ إخلاء مسؤولية قانوني : هذه الأداة مخصصة حصريًا للاستخدام في بيئات الاختبار المصرح بها. الاستخدام غير المصرح به على الأنظمة غير قانوني وقد يؤدي إلى عواقب قانونية خطيرة...
CVE-2026-106580 ImageMagick: Policy Bypass in CUT encoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash. This issue ...
CVE-2026-106580 ImageMagick: Policy Bypass in CUT encoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash. This issue ...
CVE-2023-25581
يوضح هذا السكربت بلغة Python استغلال الثغرة CVE-2023-25581 في pac4j-core. تسمح هذه الثغرة للمهاجم بتنفيذ كود عشوائي RCE عن طريق إلغاء تسلسل بيانات مشفرة بتنسيق Base64 تم إنشاؤها بشكل خبيث. المتطلبات الأساسية قبل تشغيل السكربت، تأكد من تثبيت ما يلي: Python 3.x: تحميل Python مكتبة requests: قم...
BIT-APACHE-2026-63718 Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling
Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' response smuggling vulnerability in Apache HTTP Server via modproxyuwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.68...
CVE-2026-105241
A flaw was found in Apache log4net. An attacker who can supply data that is recorded in system logs can submit unencodable Unicode characters, triggering an encoding error in the SmtpPickupDirAppender component. When this failure occurs, the application discards all buffered log messages in the...
CVE-2013-2028_Checker
CVE-2013-2028 - Débordement de tampon dans la pile lié à l'encodage par fragments dans Nginx HTTP Server 1.3.9-1.4.0 Description La fonction ngxhttpparsechunked dans http/ngxhttpparse.c dans nginx 1.3.9 à 1.4.0 permet à des attaquants distants de provoquer un déni de service plantage et d'exécute...
CVE-2025-65300
CVE-2025-65300 الوصف CVE-2025-65300: ثغرة تخزين البرمجة النصية عبر المواقع XSS في منصة Coohom SaaS تاريخ الإفصاح: 2025-10-28 آخر تحديث: 2025-10-28 المُبلغ: Phisit Pupiw البائع: Coohom CWE: CWE-79 – البرمجة النصية عبر المواقع الملخص تم تحديد ثغرة تخزين للبرمجة النصية عبر المواقع XSS في منصة Coohom...
GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File Read
GitLab CE/EE contains an unauthenticated arbitrary file read. Workhorse, the reverse proxy in front of Rails, matches upload routes using EscapedPath and path.Clean without decoding percent sequences, while Puma decodes them before routing to Grape. Appending a trailing slash to commits or...
CVE-2025-63588
CVE-2025-63588 ثغرة XSS المنعكسة في معالجة مسار cmsimplexh في CMSimpleXH تقدير CVSS v3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N → 6.1 متوسط CVE المخصص: CVE-2025-63588 المنتجات: CMSimpleXH - 1.8 المورّد: CMSimpleXH - https://www.cmsimple-xh.org/ الملخص توجد ثغرة XSS منعكسة في كود تحليل المسار الأمام...
CVE-2026-105244
Improper Encoding or Escaping of Output vulnerability in the RemoteSys...
PT-2026-107569
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash. This issue ...