CVE-2020-2034-POC

CVE-2020-2034-POC Determine the Version Running on the Palo Alto Network Firewall for the Global Protect Portal Recently a lot of critical vulnerabilities were announced by Palo Alto Networks here: https://security.paloaltonetworks.com/?severity=CRITICAL&product=PAN-OS&sort=-date This is a PoC to...

CVE-2026-82982

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and...

CVE-2026-82982

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and...

CVE-2026-82982

The Approval app's approve/reject endpoint contained a bypass in its etag freshness check , which is designed to prevent an approver from approving or rejecting a file whose contents changed after review. The backend only enforced the check when the etag parameter was present and non-empty; an at...

EUVD-2026-82619

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and...

CVE-2026-82982

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and...

PT-2026-95212

Name of the Vulnerable Software and Affected Versions Approval app affected versions not specified Description The 'approve/reject' endpoint fails to properly enforce a freshness check. The system is designed to require the current etag of a file to ensure that an approver does not act on a versi...

CVE-2026-82982: Undefined Security Weakness

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and...

curl: --etag-save - truncates append-redirected stdout

Summary saveetag line 267–273 calls fileno, fstat, ftruncatefd, 0 whenever the underlying fd is a regular file. It does not check OutStruct.regularfile, which is FALSE for stdout even when shell-redirected to a file. When --etag-save - is used with append redirection , an HTTP 2xx/3xx response...

CVE-2026-73291

Seerr (open-source media manager for Jellyfin/Plex/Emby) prior to v3.4.0 contains a flaw in ImageProxy: the code uses upstream ETag and Content-Type headers to build the cache filename for the unauthenticated GET /avatarproxy/:jellyfinUserId route. This allows a malicious or compromised Jellyfin/...

Nextcloud: Approval app's file-freshness check can be bypassed by omitting the etag parameter, allowing approval of unreviewed file changes

A vulnerability was discovered in the approval app's file-freshness check. The vulnerability allowed bypassing the check by omitting the etag parameter, enabling approval of unreviewed file changes. This broke the integrity of the approval process, as the approver could approve a different file...

Astra Linux – Vulnerability in ruby-sinatra

Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there was a denial-of-service vulnerability in the If-Match and If-None-Match header parsing component of Sinatra, if the etag method was used when constructing the response. Carefully crafted...

Regular Expression Denial Of Service (ReDoS)

sinatra is vulnerable to Denial-Of-Service. The vulnerability is due to inefficient header parsing when the etag method is used, allowing attackers to send crafted headers that consume excessive CPU time and cause denial of service...

CVE-2025-61921

A flaw was found in Sinatra. A Regular Expression Denial of Service ReDoS vulnerability can be triggered when parsing the If-Match and If-None-Match HTTP headers. A remote attacker can exploit this issue by sending a specially crafted header to an application endpoint that uses the etag method,...

Linux Distros Unpatched Vulnerability : CVE-2025-61921

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the...

SUSE CVE-2025-61921

Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the If-Match and If-None-Match header parsing component of Sinatra, if the etag method is used when constructing the response. Carefully crafted...

GHSA-MR3Q-G2MV-MR4Q Sinatra is vulnerable to ReDoS through ETag header value generation

Summary There is a denial of service vulnerability in the If-Match and If-None-Match header parsing component of Sinatra, if the etag method is used when constructing the response and you are using Ruby = 3.2...

Sinatra is vulnerable to ReDoS through ETag header value generation

Summary There is a denial of service vulnerability in the If-Match and If-None-Match header parsing component of Sinatra, if the etag method is used when constructing the response and you are using Ruby = 3.2...

CVE-2025-61921

Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the If-Match and If-None-Match header parsing component of Sinatra, if the etag method is used when constructing the response. Carefully crafted...

DEBIAN-CVE-2025-61921

Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the If-Match and If-None-Match header parsing component of Sinatra, if the etag method is used when constructing the response. Carefully crafted...