nextjs-middleware-auth-bypass-lab

Next.js Middleware Authorization Bypass CVE-2025-29927 Cos'è la vulnerabilità? Nelle applicazioni Next.js, il middleware viene eseguito prima che le richieste raggiungano l'applicazione, effettuando controlli come autenticazione e autorizzazione. Nella vulnerabilità CVE-2025-29927, a causa...

CVE-2026-66753-HTTP-Header-Injection-via-Unvalidated-CR-and-LF-in-Header-Values-tiny_http-

Security Advisory: HTTP Header Injection via Unvalidated CR and LF in Header Values tinyhttp Zugewiesene CVE-ID: CVE-2026-66753 Zusammenfassung tinyhttp lehnt Wagenrücklauf oder Zeilenvorschub in HTTP-Header-Werten nicht ab, und zwar in keiner Richtung. Auf der Anforderungsseite beendet...

log4jcheck

Northwave Log4j CVE-2021-44228 जाँचकर्ता शुक्रवार, 10 दिसंबर 2021 को एक नया प्रूफ-ऑफ-कॉन्सेप्ट 1 प्रकाशित किया गया जो जावा लाइब्रेरी 'log4j' 2 में एक रिमोट कोड एक्जीक्यूशन RCE कमजोरी को संबोधित करता है। यह कमजोरी पहले से सॉफ्टवेयर के डेवलपर्स को प्रकट नहीं की गई थी। इस कमजोरी को CVE-2021-44228 3 ...

CVE-2025-60876

CVE-2025-60876: correzione dell'iniezione nel request-target di busybox wget Una correzione che preserva il comportamento per CVE-2025-60876, una vulnerabilità di iniezione di intestazioni HTTP in BusyBox wget, più la proof-of-concept che la dimostra e gli artefatti per inviare la correzione...

CVE-2017-5638

CVE-2017-5638 Este script destina-se a validar a vulnerabilidade do Apache Struts 2 CVE-2017-5638, também conhecida como Struts-Shock. É completamente inofensivo, pois não injeta nenhum payload malicioso; apenas injeta um cabeçalho HTTP chamado 'STRUTS2-VALIDATION' para validar se o alvo é...

CVE-2026-Mastodon-Streaming-CRLF-Injection

CVE-2026-XXXXX: Mastodon स्ट्रीमिंग सर्वर में HTTP रिस्पॉन्स हेडर इंजेक्शन CRLF भेद्यता अवलोकन...

CVE-2017-5638

CVE-2017-5638 هذا السكربت مخصص للتحقق من ثغرة Apache Struts 2 CVE-2017-5638، المعروفة أيضًا باسم Struts-Shock. وهو غير ضار تمامًا لأنه لا يحقن أي حمولة خبيثة، بل يقوم فقط بحقن ترويسة HTTP باسم 'STRUTS2-VALIDATION' من أجل التحقق مما إذا كانت الثغرة موجودة. بفضل قدرته على تعدد الخيوط multithread،...

CVE-2026-50576

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration does not neutralize CRLF characters in values used by app/vau/VAUProtokoll.py to construct VAU inner HTTP requests. The...

CVE-2026-50576

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration does not neutralize CRLF characters in values used by app/vau/VAUProtokoll.py to construct VAU inner HTTP requests. The...

CVE-2026-50576 ePA 3.x Integration: HTTP Header Injection in VAU Inner Requests

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration does not neutralize CRLF characters in values used by app/vau/VAUProtokoll.py to construct VAU inner HTTP requests. The...

CVE-2026-50576

CVE-2026-50576 is a CRLF header injection vulnerability in ePA 3.x Integration , a component of Germany's electronic patient record system. The build_inner_header function in app/vau/VAUProtokoll.py interpolates user-controlled values (uri, host, accept_type, content_type, content_length, USER_AG...

Important: nodejs22

Issue Overview: brace-expansion through 5.0.6 is vulnerable to denial of service. The expand function exhibits exponential-time complexity in the number of consecutive non-expanding '' brace groups. An attacker who passes a crafted string to expand, directly or transitively, can cause significant...

CVE-2026-19879

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific...

netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected...

Server-Side Request Forgery

Apache Camel Solr component is vulnerable to Server-Side Request Forgery. The vulnerability is due to insufficient validation of SolrParam. and SolrField. headers, where attacker-controlled HTTP headers can inject arbitrary Solr request parameters or document fields, allowing unauthorized...

Improper Input Validation

Apache Camel Salesforce is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of Salesforce control headers, where attacker-controlled HTTP headers can override configured SOQL queries, SObject parameters, or Apex REST requests, allowing unauthorized acce...

netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected...

netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected...

Security Bulletin:Vulnerability in form-data affects IBM Netezza Appliance

Summary The form-data package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-12143 Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the fie...

CVE-2026-54199

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to HTTP header injection through the request body in the application's link storing functionality //ServerClientcelink.htm, which is appended to the redirect target in the 302 HTTP response. If a line feed is added, this will also be added to...