EUVD-2026-91474

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route. Attackers sign requests with their own keyId while supplying internal actor URLs in...

EUVD-2020-21308

Malware in sbrugna...

JBoss Enterprise Application Platform Information Disclosure

The vulnerability of the GET and POST methods of the JBoss Enterprise Application Platform is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor, operating remotely, to obtain confidential information through a specially crafted request...

PT-2020-17053

Name of the Vulnerable Software and Affected Versions view statistics extension versions prior to 2.0.1 for TYPO3 Description An issue in the view statistics extension saves all GET and POST data of TYPO3 frontend requests to the database. Depending on the extensions used on a TYPO3 website,...

Invoker servlets authentication bypass (HTTP verb tampering)

The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access control only for the GET and POST methods, which allow remote attackers to bypass authentication ...

JBoss Application Server Web Console Authentication bypass

The Web Console aka web-console in JBossAs in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an...