CVE-2025-71405 vulnerabilities

Vulnerabilities for packages: dapr, caddy-fips, tkn, kyverno-policy-reporter-ui, rclone-fips, kyverno-policy-reporter-ui-fips, gogatekeeper, step-issuer-fips, tkn-fips, telegraf, karma, step, cloudflared, step-ca-fips, gitness, rclone, sftpgo, step-fips, caddy, step-ca, dapr-fips, buf, step-issue...

GHSA-XCVF-46F4-XWXF vulnerabilities

Vulnerabilities for packages: step, rclone, gogatekeeper, karma, tkn, cloudflared, step-ca, buf, kyverno-policy-reporter-ui, step-issuer, gitness, caddy, sftpgo...

CVE-2025-71405 vulnerabilities

Vulnerabilities for packages: step, rclone, gogatekeeper, karma, tkn, cloudflared, step-ca, buf, kyverno-policy-reporter-ui, step-issuer, gitness, caddy, sftpgo...

CVE-2023-36845

Juniper CVE:2023-36845 자동화 - Asbawy 제작 - Ak1t4 수정 개요 CVE-2023-36845 취약점을 확인하기 위해 설계된 bash 스크립트입니다. 이 스크립트는 Juniper URL 주소 목록을 처리하고, 각 주소에 요청을 보내며, 응답에 기반하여 시스템이 취약한지 여부를 결정합니다. 사용법 스크립트를 사용하려면 다음 옵션과 함께 명령줄에서 실행하십시오: ./exploit.sh -f urls.txt 작성자: Asbawy...

CVE-2026-63570 Pkcs12Store.GetCertificateChain loops forever on cyclic issuer links

Loop with unreachable exit condition in Pkcs12Store.GetCertificateChain in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply a crafted PKCS12 file to an application that loads it and requests a key entry's certificate chain to cause a denial of service, in...

CVE-2026-63570 Pkcs12Store.GetCertificateChain loops forever on cyclic issuer links

Loop with unreachable exit condition in Pkcs12Store.GetCertificateChain in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply a crafted PKCS12 file to an application that loads it and requests a key entry's certificate chain to cause a denial of service, in...

CVE-2026-23552

CVE-2026-23552 - camel-keycloak의 렐름 간 토큰 수용 개요 Apache Camel의 KeycloakSecurityPolicy는 JWT 토큰의 iss발급자 클레임을 구성된 렐름에 대해 검증하지 않습니다. 즉, 한 Keycloak 렐름에서 발급된 토큰이 완전히 다른 렐름을 위해 구성된 정책에 의해 조용히 수락되어 테넌트 격리가 깨집니다. 영향을 받는 버전: 4.15.0, 4.16.0, 4.17.0 추적: https://issues.apache.org/jira/browse/CAMEL-22854 근본 원인...

CVE-2025-30144

요약 fast-jwt 라이브러리는 RFC https://datatracker.ietf.org/doc/html/rfc7519page-9 에 기반하여 iss 클레임을 제대로 검증하지 않습니다. 세부 사항 fast-jwt 라이브러리의 iss발급자 클레임 검증은 문자열 배열을 유효한 iss 값으로 허용합니다. 이 설계 결함으로 인해 악의적인 행위자가 'https://attacker-domain/', 'https://valid-iss' 형태의 iss 클레임을 가진 JWT를 제작하는 잠재적 공격이 가능해집니다. 허용적인 검증 때문에 해당...

EUVD-2026-90769

Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue...

CVE-2026-102102

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery SSRF. A server-side request forgery SSRF weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal o...

CVE-2026-102102

The Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a Server-Side Request Forgery (SSRF) . This weakness occurs when the gateway retrieves an issuer certificate from an inbound message, allowing a remote, unauthenticated attacker to induce the gateway to issue crafted req...

CVE-2026-102102 Kiteworks Email Protection Gateway server-side request forgery

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery SSRF. A server-side request forgery SSRF weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal o...

PT-2026-103540

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway versions prior to 9.5.0 Description A Server-Side Request Forgery SSRF weakness allows a remote, unauthenticated attacker to force the gateway to send crafted requests to internal or unintended network...

CVE-2026-50338

CVE-2026-50338 Spring Cloud Azure B2C リソースサーバー クロス発行者認証バイパス 説明 spring-cloud-azure-autoconfigure 内の AadB2cResourceServerAutoConfiguration は、AadB2cTrustedIssuerRepository.java:30 を介して AadTrustedIssuerRepository...

CVE-2026-66908

CVE-2026-66908 — camel-platform-http-main JWT iss/aud が検証されない Apache Camel の脆弱性に対する実行可能な Proof-of-Concept 再現コードです。この脆弱性では、camel-main 組み込み HTTP サーバー が、jwtIssuer も jwtAudience も設定されていない場合に、キーストアのみから JWT 認証子を構築するため、受信トークンは署名と有効期限のみ がチェックされ、iss および aud クレームは一切検証されません。 ランタイム| ディレクトリ| スタック ---|---|---...

CVE-2019-1388

CVE-2019-1388 CVE-2019-1388 UAC Windows 인증서 대화 상자 악용 설명: 이 CVE 익스플로잇은 UAC Windows 인증서 대화 상자를 악용하여, 인증서 발급자 링크를 NT Authority 사용자로 실행하고 NT Authority 사용자 권한의 브라우저를 엽니다. 그런 다음 이를 사용하여 NT Authority 사용자 권한의 셸을 띄울 수 있습니다. 단계: 1 UAC 프롬프트 화면을 트리거할 수 있는 프로그램을 찾습니다. 2 "자세히 보기"를 선택합니다. 3 "게시자 인증서 정보 표시"를...

CVE-2026-100720

Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer the lowest-privileged authenticated role uploads an SSL certificate for one of their own domains, the Certificates API add/update methods parse it with opensslx509parse and store the issuer organization...

CVE-2026-100720 Froxlor before 2.3.12 Stored XSS via SSL certificate issuer

Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer the lowest-privileged authenticated role uploads an SSL certificate for one of their own domains, the Certificates API add/update methods parse it with opensslx509parse and store the issuer organization...

EUVD-2026-87693

Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer the lowest-privileged authenticated role uploads an SSL certificate for one of their own domains, the Certificates API add/update methods parse it with opensslx509parse and store the issuer organization...

CVE-2026-100720 Froxlor before 2.3.12 Stored XSS via SSL certificate issuer

Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer the lowest-privileged authenticated role uploads an SSL certificate for one of their own domains, the Certificates API add/update methods parse it with opensslx509parse and store the issuer organization...