268 matches found
Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode
Summary nltk.pathsec provides an SSRF filter that NLTK documents as a security control, blocking loopback, private, link-local, and multicast ranges including obfuscated forms and recommending strict ENFORCE mode for security-sensitive environments. The filter is bypassable by DNS rebinding:...
The vulnerability of the HTTPConnection.urlopen() method in the HTTP library of the Urllib3 Python programming language, which allows attackers to gain unauthorized access to protected information.
The vulnerability of the HTTPConnection.urlopen method in the Python HTTP library, Urllib3, is related to insufficient protection of sensitive data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...
Astra Linux – Vulnerability in Python 2.7, Pypy
In Python 3.x versions prior to 3.5.10, 3.6.x versions prior to 3.6.12, 3.7.x versions prior to 3.7.9, and 3.8.x versions prior to 3.8.5, CRLF injection is allowed if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of...
python: Fix of 4 CVEs
CVE-2019-9740: reject control characters in HTTP URL paths in httplib.HTTPConnection.putrequest to prevent CRLF header injection - CVE-2019-18348: reject control characters in hostnames in httplib.HTTPConnection.init via a new validatehost helper to prevent CRLF header injection the glibc...
urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
Impact When following cross-origin redirects for requests made using urllib3’s high-level APIs, such as urllib3.request, PoolManager.request, and ProxyManager.request, sensitive headers — Authorization, Cookie, and Proxy-Authorization defined in Retry.DEFAULTREMOVEHEADERSONREDIRECT — are stripped...
EUVD-2026-10804
Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, a logic vulnerability in Envoy's HTTP connection manager FilterManager that allows for Zombie Stream Filter Execution. This issue creates a "Use-After-Free" UAF or state-corruption window where...
Envoy 资源管理错误漏洞
Envoy is an open-source gateway program developed by Enphase for connecting smart home devices. Versions of Envoy prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13 contain a resource management vulnerability. This vulnerability stems from logical flaws in the HTTP connection manager, which may lead to...
Improper Handling of Case Sensitivity
Overview Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity in the processing of HTTP/1.1 requests when handling the Connection header with X-Forwarded headers. An attacker can cause the removal of forwarded identity headers by sending requests with lowercas...
CVE-2025-63561
CVE-2025-63561 affects the Summer Pearl Group Vacation Rental Management Platform prior to version 1.0.2 . The vulnerability is a Slowloris-style denial-of-service in the HTTP connection handling layer, where an attacker can open and maintain many slow or incomplete HTTP connections to exhaust th...
arkadiyt-projects: DNS Rebinding Attack
Hi, there is a DNS rebinding vulnerability in your SSRF filter. F4891755 You validate the hostname's IP address, but then pass the hostname to Net::HTTP.start, which does its own DNS lookup. An attacker can control a DNS server that returns a safe public IP during validation, then returns 127.0.0...
EUVD-2020-7752
Malware in sbrugna...
EUVD-2014-0137
Malware in sbrugna...
EUVD-2016-7978
Malware in sbrugna...
EUVD-2015-0211
Malware in sbrugna...
EUVD-2017-8193
Malware in sbrugna...
EUVD-2012-2425
Malware in sbrugna...
EUVD-2012-2426
Malware in sbrugna...
EUVD-2004-0264
Malware in sbrugna...