6638 matches found
CGA-W992-2C5M-55J4
Bulletin has no description...
openssh: OpenSSH: sftp client allows attacker to control downloaded file location
A flaw was found in OpenSSH. The sftp client, when used to download files from a malicious server with the 'sftp server:/path .' command, does not properly restrict where those files are saved. This allows an attacker to control the download location, potentially overwriting existing files or...
ECHO-52C2-F87F-531C
Bulletin has no description...
PT-2026-57044
Name of the Vulnerable Software and Affected Versions openrun affected versions not specified Description Restrictions on redirect URLs can be bypassed, leading to open redirect attacks. The issue occurs because the validation logic only verifies that the host and schema of the redirect URL match...
GHSA-43FC-V873-QW85 Waku has an Open Redirect via `unstable_redirect` Helper
Summary The unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation, scheme restriction, or path-only enforcement. Any applicatio...
Waku has an Open Redirect via `unstable_redirect` Helper
Summary The unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation, scheme restriction, or path-only enforcement. Any applicatio...
DRUPAL-CONTRIB-2026-072
The Location Selector module provides a Views filter for selecting location values. One of the provided Views filters does not sufficiently sanitize values that may come from user input, resulting in a SQL injection vulnerability. This vulnerability is mitigated by the fact that a View must exist...
CGA-23H4-WW2P-GFPP
Bulletin has no description...
MINI-65J4-PMRH-92R8
Bulletin has no description...
MINI-QHQG-99HJ-VMJ3
Bulletin has no description...
MINI-85VV-FMVW-HWPM
Bulletin has no description...
CVE-2026-59995
A flaw was found in OpenSSH. The sftp client, when used to download files from a malicious server with the 'sftp server:/path .' command, does not properly restrict where those files are saved. This allows an attacker to control the download location, potentially overwriting existing files or...
AZL-92042 CVE-2026-59995 affecting package openssh for versions less than 9.8p1-9
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server...
CVE-2026-59995
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server...
EUVD-2026-42137
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server...
PT-2026-56673
Name of the Vulnerable Software and Affected Versions Waku versions prior to 1.0.0-beta.1 Description The unstable redirect function exported from waku/router/server accepts an arbitrary string and reflects it unchanged into the HTTP Location response header without URL validation, scheme...
PT-2026-56661
Name of the Vulnerable Software and Affected Versions Location Selector versions 0.0.0 through 1.3.0 Description An SQL injection issue exists in the Location Selector module, which provides a Views filter for selecting location values. A specific Views filter fails to sufficiently sanitize value...
PT-2026-56286
Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 10.4 Description The sftp client does not properly constrain the location of downloaded files when the command sftp server:/path . is used to connect to an attacker-controlled server. Recommendations Update to version...
Location Selector - Critical - SQL Injection - SA-CONTRIB-2026-072
The Location Selector module provides a Views filter for selecting location values. One of the provided Views filters does not sufficiently sanitize values that may come from user input, resulting in a SQL injection vulnerability. This vulnerability is mitigated by the fact that a View must exist...