CVE-2025-45955

CVE-2025-45955 DonWeb Ferozo의 서버 측 요청 위조 CVE-2025-45955 설명 공격자는 Ferozo 호스팅 플랫폼에 특수하게 조작된 PHP 파일을 업로드하고 실행하여 이 취약점을 악용할 수 있습니다. 해당 파일에 접근하면 내부 서비스예: 127.0.0.1, 169.254.169.254 또는 서비스 메시 엔드포인트, 로컬 파일예: file:///etc/passwd, 알려진 클라우드 메타데이터 엔드포인트를 대상으로 일련의 SSRF 시도를 실행합니다. 스크립트는 응답 또는 오류 메시지를 수집하여 공격자가 ...

mongobleed

MongoDB 압축 누출 연구소 안전한, 교육용 참조 CVE : CVE-2025-14847 이 저장소는 데이터베이스 와이어 프로토콜에서 흔히 "압축 프레이밍 / 크기 메타데이터 메모리 노출"로 설명되는 문제 유형의 개념 을 보여주는 교육용 연구소 입니다. 이는 방어적 이해를 돕기 위해 작성되었습니다: MongoDB 네트워크 압축이 어떻게 협상되고 프레이밍되는지 , 크기 필드가 왜 중요한지 , 그리고 강력한 파서가 의도치 않은 메모리 노출을 어떻게 방지하는지. CVE 참조에 대한 참고 사항: 이 연구소는 CVE-2025-1484...

CVE-2026-33267-PoC

CVE-2026-33267 — Apache Traffic Server の信頼できない @ ヘッダー → 内部メタデータの偽装 CVSS 10.0（緊急） · CWE-20 · GHSA-jrh6-9hgv-mqm7 概要 Apache Traffic Server は @ で始まるヘッダー（@Ats-Internal、@ICAP-Status、@TCPInfo、...）を内部メタデータ...

[SECURITY] Fedora 45 Update: localsearch-3.12.0-2.fc45

Tinysparql is a powerful desktop-neutral first class object database, tag/metadata database and search tool. This package contains various miners and metadata extractors for tinysparql...

[SECURITY] Fedora 45 Update: appstream-generator-0.10.1-5.fc45

appstream-generator is a tool to generate distribution metadata from package repositories. It will extract icons, download screenshots, validate and transform the metadata, and return XML or YAML files that can be read by AppStream clients, such as software centers. It will also generate issue...

EUVD-2026-60585

SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers...

CVE-2023-37941

Superset 기본 캐시 내 Pickle RCE 악용 정보 저자 Dinis Cruz 프로젝트 Superset 설명 Apache Superset는 캐싱을 위한 여러 옵션을 제공하며, 모두 Flask-Caching을 기반으로 합니다. 내장 캐시는 값을 나중에 검색하기 위해 직렬화합니다. 이 직렬화 및 검색은 Pickle을 사용하여 수행되며, 이는 Python 객체의 역직렬화를 허용하여 코드 실행으로 이어집니다. 내장 캐시는 메타데이터 데이터베이스에 정보를 기록하며, 이는 이 데이터베이스에 접근할 수 있는 공격자가 권한을 상승시키...

ESXiArgs-Recover

ESXiArgs-Recover ESXiArgs-Recover は、ESXiArgs ランサムウェア攻撃の影響を受けた仮想マシンの復旧を組織が試みることを可能にするツールです。 CISA は、一部の組織が身代金を支払わずにファイルの復旧に成功したと報告していることを把握しています。CISA は、Enes Sonmez 氏と Ahmet Aykac 氏によるチュートリアルを含む公開リソースに基づいてこのツールをまとめました。このツールは、マルウェアによって暗号化されなかった仮想ディスクから仮想マシンのメタデータを再構築することで機能します。詳細については、CISA の ESXiArgs...

CVE-2026-82040

UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl that allows authenticated attackers to make the server send requests to arbitrary internal or cloud metadata hosts by supplying a malicious metadata URL to the...

CVE-2026-12392

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option...

CVE-2026-82040 UTMStack < 11.2.16 SSRF via IdentityProviderService

UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl that allows authenticated attackers to make the server send requests to arbitrary internal or cloud metadata hosts by supplying a malicious metadata URL to the...

CVE-2026-82040

UTMStack versions before 11.2.16 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability within the IdentityProviderService.validateMetadataUrl() function. Authenticated attackers can exploit the POST/PUT /api/identity-providers endpoint because the application fails to validate the...

EUVD-2026-91792

UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl that allows authenticated attackers to make the server send requests to arbitrary internal or cloud metadata hosts by supplying a malicious metadata URL to the...

CVE-2026-82040 UTMStack < 11.2.16 SSRF via IdentityProviderService

UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl that allows authenticated attackers to make the server send requests to arbitrary internal or cloud metadata hosts by supplying a malicious metadata URL to the...

Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL

Summary A project member can create a webhook alert channel whose delivery URL points at an internal address, and trigger.dev's control plane will send the alert there with no SSRF protection. The webhook URL is stored as an unvalidated string and is fetched directly from the webapp server, so a...

GHSA-XXV7-2VV3-H682 Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL

Summary A project member can create a webhook alert channel whose delivery URL points at an internal address, and trigger.dev's control plane will send the alert there with no SSRF protection. The webhook URL is stored as an unvalidated string and is fetched directly from the webapp server, so a...

EUVD-2026-91775

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option...

CVE-2026-12392

An information exposure vulnerability exists in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 . An unauthenticated attacker can retrieve the RPC secret in plaintext via the vendor data metadata endpoint . This is specifically possible if a target machine was deployed wi...

CVE-2026-12392 RPC secret disclosure via vendor data endpoint in Canonical MAAS

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option...

CVE-2026-12392 RPC secret disclosure via vendor data endpoint in Canonical MAAS

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option...