130 matches found
CVE-2026-86490
In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint...
PoC-for-CVE-2021-38540-
CVE-2021-38540 概念验证 关键组件缺少身份验证，即 CVE-2021-38540 关于此漏洞： Airflow =2.0.0, =2.0.0, variables List Variables 下创建一个名为 kafkacaptainhookuser 的变量。 PoC 源码： root@kitploit: POST /variable/varimport HTTP/2 Host: airflow.example.com User-Agent: Mozilla/5.0 X11; Linux x8664; rv:91.0 Gecko/20100101 Firefox/91.0...
CVE-2026-86490
In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint...
EUVD-2026-72506
In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint...
CVE-2026-86490
In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint...
CVE-2026-86490
JetBrains YouTrack versions before 2026.2.18634 are affected by improper permission checks in the app import endpoint , allowing an authenticated attacker to overwrite bundled applications. The vulnerability yields a CVSS 3.1 score of 6.5 (Medium) with high integrity impact , exploitable over the...
CVE-2026-76594
A flaw was found in advisor-backend. A network-adjacent unauthenticated attacker could exploit a vulnerability in the /private/importcontent/ endpoint, which lacks proper authentication and permission checks. This allows the attacker to overwrite the global Advisor rule, resolution, and playbook...
CVE-2026-54600
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero fresh/unconfigured install, an unauthenticated attacker can replace the entire database. This issue has...
CVE-2026-54600
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4 , the endpoints/db/import.php endpoint lacks authentication. The only protective guard is a check on the user-table row count: if the count is zero (as in a fresh or unconfigured install ), an unauthenti...
CVE-2026-54600 Wallos: Unauthenticated database replacement via import endpoint on fresh install
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero fresh/unconfigured install, an unauthenticated attacker can replace the entire database. This issue has...
CVE-2026-54600 Wallos: Unauthenticated database replacement via import endpoint on fresh install
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero fresh/unconfigured install, an unauthenticated attacker can replace the entire database. This issue has...
PT-2026-83990
Name of the Vulnerable Software and Affected Versions Wallos versions prior to 4.9.4 Description An authentication bypass exists in the 'endpoints/db/import.php' endpoint. On fresh or unconfigured installations where the user table row count is zero, an unauthenticated attacker can replace the...
JetBrains YouTrack < 2026.2.18177 DoS (CVE-2026-75047)
The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.18177. It is, therefore, affected by a denial of service vulnerability: - A DoS attack was possible via a decompression bomb in the import endpoint. CVE-2026-75047 Note that Nessus has not tested for this issue but...
CVE-2026-75047
In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint...
CVE-2026-75047
JetBrains YouTrack before version 2026.2.18177 is vulnerable to a denial-of-service attack via a decompression bomb submitted to the import endpoint. A low-privileged authenticated user can trigger high availability impact (CVSS 6.5) without user interaction. Exploitation details are not provided...
CVE-2026-75047
In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint...
CVE-2026-75047
In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint...
EUVD-2026-60246
In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint...