667 matches found
Serverless-Top-10-Project
OWASP Serverless Top 10 개요 서버리스 아키텍처를 채택하면 애플리케이션을 관리하기 위한 서버를 직접 구축할 필요가 없어집니다. 그렇게 함으로써 보안 위협 중 일부는 인프라 제공업체에 넘어가게 됩니다. 비용 및 확장성과 같은 서버리스 애플리케이션 개발의 많은 장점에 더해, 일부 보안 측면도 일반적으로 신뢰할 수 있는 서비스 제공업체에 위임됩니다. 그러나 이러한 애플리케이션이 프로비저닝 서버 없이 실행되더라도 여전히 코드를 실행합니다. 이 코드가 안전하지 않은 방식으로 작성된 경우, 애플리케이션은...
Log4Shell-CVE-2021-44228-Demo
CVE-2021–44228 Demo 1. CVE-2021–44228 소개 2021년 말 사이버 보안 업계에서 가장 큰 뉴스는 Log4j의 취약점이었습니다. CVE-2021-44228로 번호가 부여되었으며 Log4Shell 이라고도 불립니다. CVSS 취약점 평가 시스템에서 가장 심각한 등급인 10점 을 받았으며, 최근 Heartbleed와 ShellShock에 이어 가장 중대한 취약점으로 간주됩니다. 어떤 이들은 이를 '핵폭탄급 취약점'이라고 묘사할 정도로 그 영향이 매우 깊습니다. 이 과제는 CVE-2021-44228을...
BinAbsInspector
Что такое BinAbsInspector? BinAbsInspector Binary Abstract Inspector — это статический анализатор для автоматического реверс-инжиниринга и поиска уязвимостей в бинарных файлах, который является долгосрочным исследовательским проектом, разрабатываемым в Keenlab. Он основан на абстрактной...
starlette-host-header-lab
Starlette Host-Header URL Confusion Lab X41-2026-002 Автономный, контейнеризированный учебный лабораторный стенд, воспроизводящий уязвимость обхода аутентификации в Starlette, раскрытую X41 D-Sec. Консультация: X41-2026-002 GHSA: GHSA-86qp-5c8j-p5mr CWE: 436 — Конфликт интерпретации / Недоверенны...
ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass
A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...
ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass
A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...
Security Bulletin: Security vulnerability has been found in IBM Verify Identity Access Digital Credentials (CVE-2026-16221)
Summary Security vulnerability has been addressed in IBM Verify Identity Access Digital Credentials Vulnerability Details CVEID:CVE-2026-16221 DESCRIPTION: Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal...
CVE-2026-18246
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to an interpretation conflict in the multipart parser...
Exploit for Interpretation Conflict in Wordpress
C...
Interpretation Conflict
Overview org.webjars.npm:fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Interpretation Conflict due to malformed authority introducer handling in parseWithStatus and resolve in index.js. An attacker can bypass host-based URL checks and steer...
Security Bulletin: MongoDB Enterprised Advanced affected by: Interpretation Conflict (CVE-2026-6322)
Summary There are vulnerabilities in fast-uri-3.0.1.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-6322. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-6322 DESCRIPTION: fast-uri normalize decoded percent-encoded authority delimiters inside the ho...
Interpretation Conflict
Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Interpretation Conflict via the parseCacheControlHeader function in lib/util/cache.js and the cache interceptor. An attacker can cause a shared cached response containing...
Interpretation Conflict
Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Interpretation Conflict via the parseCacheControlHeader function in lib/util/cache.js and the cache interceptor. An attacker can cause a shared cached...
CVE-2026-24033
Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3, from 9.0.0 through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the iss...
Exploit for Interpretation Conflict in Wordpress
wp2shell CVE-2026-63030 + CVE-2026-60...
GO-2026-5074 Go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation in github.com/go-git/go-git
Go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation in github.com/go-git/go-git...
WordPress Core Interpretation Conflict Vulnerability
WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137...
Interpretation Conflict
Overview org.webjars.npm:fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Interpretation Conflict via literal backslash handling in parseWithStatus in index.js. An attacker can bypass host-based validation by supplying a URI such as...
Interpretation Conflict
Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Interpretation Conflict via literal backslash handling in parseWithStatus in index.js. An attacker can bypass host-based validation by supplying a URI such as...
