Lucene search
+L

574 matches found

Kitploit
Kitploit
added 2026/09/12 1:58 a.m.10 views

MemorizingTrustManager

MemorizingTrustManager - Soporte de nube privada para tu aplicación MemorizingTrustManager MTM es un proyecto para permitir un uso de SSL en Android más inteligente y seguro. Si encuentra un certificado SSL desconocido, pregunta al usuario si desea aceptar el certificado una vez, permanentemente ...

6AI score
SaveExploits0References1
RedHat Linux
RedHat Linux
added 2026/09/11 7:06 a.m.6 views

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

9.6CVSS5.8AI score0.00692EPSS
SaveExploits0References8
RedHat Linux
RedHat Linux
added 2026/09/09 4:12 p.m.5 views

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

9.6CVSS5.8AI score0.00692EPSS
SaveExploits0References8
RedHat Linux
RedHat Linux
added 2026/09/09 11:17 a.m.7 views

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

9.6CVSS5.8AI score0.00692EPSS
SaveExploits0References8
RedHat Linux
RedHat Linux
added 2026/09/08 6:13 p.m.5 views

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

9.6CVSS5.8AI score0.00692EPSS
SaveExploits0References8
RedHat Linux
RedHat Linux
added 2026/09/08 12:18 p.m.5 views

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

9.6CVSS5.8AI score0.00692EPSS
SaveExploits0References8
RedHat Linux
RedHat Linux
added 2026/09/08 12:08 p.m.6 views

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

9.6CVSS5.8AI score0.00692EPSS
SaveExploits0References8
Kitploit
Kitploit
added 2026/09/08 10:29 a.m.6 views

CVE-2026-34207

CVE-2026-34207 SSRF过滤器检查了主机名字符串,但实际目的地是由后续的DNS决定的。这一漏洞使得攻击者控制的Webhook URL能够到达回环地址、元数据服务和私有网络目标。 介绍 我在审查Typebot (一个开源聊天机器人构建器)时发现了这个漏洞,心中带着一个简单的安全问题: 如果SSRF保护验证的是主机名字符串,而实际目的地是由后续的DNS决定的,会发生什么? 在这个案例中,这个问题引出了一个真正的漏洞。 Typebot 的 Webhook / HTTP 请求块的 SSRF 保护仅验证了: URL 字符串, 封禁了主机名字面量, 以及字面量 IP 格式 它没有...

7.6CVSS5.9AI score0.00239EPSS
SaveExploits2References1
Kitploit
Kitploit
added 2026/09/06 10:56 p.m.6 views

CVE-2026-78850

Matomo SiteContentDetector Autenticado con SSRF Ciego Reportero Nombre: CYBER-SEC Contacto: [email protected] Resumen Matomo permite que un administrador de sitio autenticado configure el mainurl de un sitio con una dirección interna. Cualquier usuario autenticado con acceso de vista puede...

5.9AI score
SaveExploits0References1
RedHat Linux
RedHat Linux
added 2026/09/03 9:30 a.m.12 views

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

9.6CVSS6.3AI score0.00692EPSS
SaveExploits0References8
EUVD
EUVD
added 2026/09/02 12:31 a.m.10 views

EUVD-2026-69711

The values of the mail.allowedattachmenthostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 15...

5.9AI score0.00254EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/08/31 5:53 a.m.11 views

CVE-2026-62243

A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...

8.7CVSS5.8AI score0.00155EPSS
SaveExploits0References5
RedHat Linux
RedHat Linux
added 2026/08/31 4:12 a.m.14 views

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

9.6CVSS6.3AI score0.00692EPSS
SaveExploits0References8
RedHat Linux
RedHat Linux
added 2026/08/31 4:11 a.m.12 views

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

9.6CVSS6.3AI score0.00692EPSS
SaveExploits0References8
NVD
NVD
added 2026/08/28 8:20 p.m.11 views

CVE-2026-82289

Gitingest through 0.3.1 fails to properly validate hostnames in validatehost, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostnames to trigger outbound connections to arbitrary hosts and...

8.3CVSS0.00247EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/08/28 4:19 p.m.13 views

EUVD-2026-67820

Gitingest through 0.3.1 fails to properly validate hostnames in validatehost, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostnames to trigger outbound connections to arbitrary hosts and...

8.3CVSS6AI score0.00247EPSS
SaveExploits0References5
OSV
OSV
added 2026/08/28 4:19 p.m.12 views

CVE-2026-82289 Gitingest Prefix-Based Git Host Check Enables Request Forgery and Token Disclosure

Gitingest through 0.3.1 fails to properly validate hostnames in validatehost, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostnames to trigger outbound connections to arbitrary hosts and...

8.3CVSS6AI score
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/08/27 12:00 a.m.11 views

PT-2026-82435

resolv 0.7.2 and 0.3.2 are out, fixing CVE-2026-80212 memory exhaustion and CVE-2026-80213 hostname validation bypass. Only code that resolves names through the resolv gem is affected. Ordinary socket and Net::HTTP connections are not. https://t.co/DF8XaeW39C...

5.2AI score0.00569EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/08/27 12:00 a.m.11 views

PT-2026-82434

resolv 0.7.2 and 0.3.2 are out, fixing CVE-2026-80212 memory exhaustion and CVE-2026-80213 hostname validation bypass. Only code that resolves names through the resolv gem is affected. Ordinary socket and Net::HTTP connections are not. https://t.co/DF8XaeW39C...

5.2AI score0.00569EPSS
SaveExploits0References1
RubySec
RubySec
added 2026/08/27 12:00 a.m.10 views

CVE-2026-80213 - Hostname validation bypass

An application that checks a hostname against an allow list or an SSRF filter and then resolves it can be made to look up a domain other than the one it checked. The string that passes validation and the name that reaches the network are not the same, so the connection can end up at a host the...

4CVSS5.9AI score0.0035EPSS
SaveExploits0References1Affected Software1
Rows per page
Query Builder