openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission

A flaw was found in OpenSSL. The Datagram Transport Layer Security DTLS retransmission mechanism fails to properly handle handshake message writes that are suspended before completion. A remote attacker could exploit this vulnerability during handshake message retransmission, causing OpenSSL to...

kygocera

kygocera CVE-2022-1026 نسخة محسّنة بلغة Go من PoC الخاصة بـ Rapid7 لـ CVE-2022-1026 https://www.rapid7.com/blog/post/2022/03/29/cve-2022-1026-kyocera-net-view-address-book-exposure/ إشادة إلى Aaron Herndon / https://twitter.com/ac3lives تحيات إلى https://github.com/D4RKMATT3R CVE-2022-1026 تثبيت...

CVE-2021-21042

CVE-2021-21042 مستوحى من https://www.zerodayinitiative.com/blog/2021/2/17/zdi-21-171-getting-information-disclosure-in-adobe-reader-through-the-id-tag...

openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission

A flaw was found in OpenSSL. The Datagram Transport Layer Security DTLS retransmission mechanism fails to properly handle handshake message writes that are suspended before completion. A remote attacker could exploit this vulnerability during handshake message retransmission, causing OpenSSL to...

CVE-2026-92555

The AKINSOFT WOLVOX Control Panel by AKIN Software Computer Import-Export Industry and Trade Co. Ltd. is vulnerable to an insertion of sensitive information into sent data (CWE-201). This flaw allows an attacker to pull data from system resources , potentially including database credentials . The...

EUVD-2026-94867

Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when applying DANE RFC 7672 to outbound SMTP delivery. The server's validating DNSSEC resolver treated a TLSA or MX lookup that did not complete no answer, SERVFAIL, a malformed reply, an answer without the requested records and without...

EUVD-2026-94855

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's data. The installer created the data, log, temp, database and event folders and the hMailServer.INI configuration file with the...

cve-2025-14847

MongoBleed: أداة اكتشاف تسرب الذاكرة CVE-2025-14847 MongoBleed هي أداة تدقيق أمني عالية الأداء مصممة لاكتشاف وإظهار CVE-2025-14847. تسمح هذه الثغرة لمهاجم غير مصادق عن بعد بتسريب أجزاء من ذاكرة heap غير المهيأة من خادم MongoDB من خلال استغلال خلل في عدم تطابق الطول في منطق فك ضغط zlib. 🛡️ نظرة عام...

CVE-2025-62168

CVE-2025-62168 — إثبات المفهوم PoC لتسريب رموز Squid Proxy لا يتحمل المؤلف أي مسؤولية عن سوء الاستخدام أو الأضرار الناجمة عن هذه الأداة. يُقدَّم البحث لأغراض تعليمية ودفاعية فقط. الوصف يحتوي هذا المستودع على إثبات مفهوم PoC للثغرة CVE-2025-62168 ، وهي خلل في كشف المعلومات يؤثر على Squid Proxy. في...

CVE-2025-69581

CVE-2025-69581 تم اكتشاف مشكلة في Chamillo LMS 1.11.2. يعرض نقطة النهاية /personaldata الخاصة بالشبكة الاجتماعية معلومات حساسة كاملة للمستخدم حتى بعد تسجيل الخروج بسبب عدم وجود تحكم مناسب في التخزين المؤقت cache-control. يؤدي استخدام زر الرجوع في المتصفح إلى استعادة جميع البيانات الشخصية، مما يسم...

CVE-2023-5612

كشف البريد الإلكتروني العام في خلاصة RSS للعلامات Tags https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ تم اكتشاف ثغرة في GitLab تؤثر على جميع الإصدارات قبل 16.6.6 و16.7 قبل 16.7.4 و16.8 قبل 16.8.1. كان من الممكن قراءة عنوان البريد الإلكتروني للمستخدم...

CVE-2026-71896

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions. The endpoint fails to enforce the necessary authorization checks before returni...

CVE-2026-12260

SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attacke...

EUVD-2026-94811

A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows multiple email addresses to be accepted by manipulating the email field in the /api/method/press.api.account.signup endpoint. The vulnerability occurs when an...

EUVD-2026-94810

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions. The endpoint fails to enforce the necessary authorization checks before returni...

CVE-2026-71896

An authorization vulnerability exists in Apache DolphinScheduler affecting versions before 3.4.3 . The /dolphinscheduler/users/list-all endpoint fails to properly enforce authorization checks, allowing authenticated users to retrieve account information of other users without required permissions...

CVE-2026-71183 Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints. These endpoints fail to enforce the required data source access controls...

CVE-2026-71183

An authorization vulnerability in Apache DolphinScheduler (versions before 3.4.3 ) allows authenticated users to access data sources they are not authorized to view. The /unauth-datasource and /authed-datasource endpoints fail to enforce proper access controls, potentially leaking sensitive conne...

kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads

A flaw was found in the Linux kernel's RDMA Remote Direct Memory Access subsystem, specifically within the rxe driver. A remote attacker could exploit this vulnerability by sending a specially crafted ATOMICWRITE request with a zero-byte payload. This improper handling of non-8-byte ATOMICWRITE...

kernel: ipv6: validate extension header length before copying to cmsg

A flaw was found in the Linux kernel's IPv6 networking stack. An unprivileged local user could exploit a vulnerability in how IPv6 extension header lengths are handled. By manipulating these headers using nftables, an attacker can trigger an out-of-bounds read, leading to information disclosure...