36 matches found
CVE-2026-57953
Mythic before 3.4.0.60 contains an authorization bypass vulnerability that allows authenticated spectator-role users to perform unauthorized write operations by accessing the eventingimportautomaticwebhook endpoint registered under spectator-permitted middleware. Attackers with spectator role can...
CVE-2026-57953
The vulnerability affects Mythic prior to version 3.4.0.60 and is due to an authorization bypass that allows authenticated spectator-role users to perform unauthorized write operations via the eventing_import_automatic_webhook endpoint registered under spectator-permitted middleware. Exploitation...
EUVD-2026-40138
Mythic before 3.4.0.60 contains an authorization bypass vulnerability that allows authenticated spectator-role users to perform unauthorized write operations by accessing the eventingimportautomaticwebhook endpoint registered under spectator-permitted middleware. Attackers with spectator role can...
GHSA-45GG-VH54-H5M9 vulnerabilities
Vulnerabilities for packages: commercial-expanso-edge, trivy-operator, loki, nerdctl, cilium-cli, kube-arangodb-fips, telegraf, k9s-fips, flux-fips, knative-eventing-fips, skaffold, helm, argo-cd, gitlab-rails-ce, tekton-pipelines-fips, kubescape-server, trivy, opentofu, zot, gitea,...
GHSA-78H2-9FRX-2JM8 vulnerabilities
Vulnerabilities for packages: conftest, ory-kratos-fips, hydra-fips, melange, bank-vaults, istio-fips, dagdotdev, distribution-fips, containerd-fips, step-issuer-fips, undock, falcoctl-fips, terraform-provider-acme, cluster-api-aws-controller, sqlexporter, tekton-pipelines-fips, tfsec,...
Konica Bizhub Multifunction Printers Server-Side Request Forgery (CVE-2024-51981)
An unauthenticated attacker may perform a blind server side request forgery SSRF, due to a CLRF injection issue that can be leveraged to perform HTTP request smuggling. This SSRF leverages the WS-Addressing feature used during a WS-Eventing subscription SOAP operation. The attacker can control al...
CVE-2019-11466
In Couchbase Server 6.0.0 and 5.5.0, the eventing service exposes system diagnostic profile via an HTTP endpoint that does not require credentials on a port earmarked for internal traffic only. This has been remedied in version 6.0.1 and now requires valid credentials to access...
EUVD-2009-0425
Malware in sbrugna...
EUVD-2019-3139
Malware in sbrugna...
EUVD-2024-54701
Malicious code in bioql PyPI...
CVE-2025-47906 vulnerabilities
Vulnerabilities for packages: prometheus-adapter, nats, configmap-reload-fips, kubeflow-katib, git-lfs, lvm-driver, addon-resizer, bank-vaults, dagdotdev, gitsign, prometheus-process-exporter, wazero-fips, vexctl, sftpgo-plugin-pubsub, memcached-exporter-fips, grafana-operator,...
GHSA-GWRF-JF3H-W649 vulnerabilities
Vulnerabilities for packages: prometheus-adapter, nats, configmap-reload-fips, kubeflow-katib, git-lfs, lvm-driver, addon-resizer, bank-vaults, dagdotdev, gitsign, prometheus-process-exporter, wazero-fips, vexctl, sftpgo-plugin-pubsub, memcached-exporter-fips, grafana-operator,...
CVE-2024-51981
An unauthenticated attacker may perform a blind server side request forgery SSRF, due to a CLRF injection issue that can be leveraged to perform HTTP request smuggling. This SSRF leverages the WS-Addressing feature used during a WS-Eventing subscription SOAP operation. The attacker can control al...
CVE-2024-51981 Unauthenticated Server Side Request Forgery (SSRF) via WS-Eventing affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, and Toshiba Tec, and Konica Minolta, Inc.
An unauthenticated attacker may perform a blind server side request forgery SSRF, due to a CLRF injection issue that can be leveraged to perform HTTP request smuggling. This SSRF leverages the WS-Addressing feature used during a WS-Eventing subscription SOAP operation. The attacker can control al...
CVE-2024-51981
CVE-2024-51981 describes an unauthenticated SSRF via a CLRF injection that can be exploited during a WS-Eventing SOAP subscription (WS-Addressing). The issue allows an attacker to control all HTTP data sent in the SSRF connection but cannot receive data from the connection, enabling network-bound...
CVE-2024-51981: Server-Side Request Forgery (SSRF)
An unauthenticated attacker may perform a blind server side request forgery SSRF, due to a CLRF injection issue that can be leveraged to perform HTTP request smuggling. This SSRF leverages the WS-Addressing feature used during a WS-Eventing subscription SOAP operation. The attacker can control al...
GO-2023-2388 eventing-github vulnerable to denial of service caused by improper enforcement of the timeout on individual read operations in knative.dev/eventing-github
eventing-github vulnerable to denial of service caused by improper enforcement of the timeout on individual read operations in knative.dev/eventing-github...
GHSA-99JV-8292-2HPM eventing-gitlab vulnerable to denial of service, caused by improper enforcement of the timeout on individual read operations
Impact The eventing-gitlab cluster-local server doesn't set ReadHeaderTimeout which could lead do a DDoS attack, where a large group of users send requests to the server causing the server to hang for long enough to deny it from being available to other users, also know as a Slowloris...
eventing-gitlab vulnerable to denial of service, caused by improper enforcement of the timeout on individual read operations
Impact The eventing-gitlab cluster-local server doesn't set ReadHeaderTimeout which could lead do a DDoS attack, where a large group of users send requests to the server causing the server to hang for long enough to deny it from being available to other users, also know as a Slowloris...
GHSA-V7HC-87JC-QRRR eventing-github vulnerable to denial of service caused by improper enforcement of the timeout on individual read operations
Impact The eventing-github cluster-local server doesn't set ReadHeaderTimeout which could lead do a DDoS attack, where a large group of users send requests to the server causing the server to hang for long enough to deny it from being available to other users, also know as a Slowloris...