Sudo-Vulnerability-Exploit-CVE-2019-14287

Sudo漏洞利用——CVE-2019-14287 Sudo被发现不可靠，它是几乎任何基于Unix和Linux的操作系统中最重要、最强大且最常用的实用程序之一，作为一个简单的命令存在。一个伪安全策略绕过缺陷，允许恶意用户或应用程序在目标Linux设备上执行任意命令。该错误需要非标准设置才能触发。换句话说，Linux机器本身并不会自然地被破坏。错误的用户只应在Linux操作系统上执行命令时使用“Super User Do”命令，通过将用户ID定义为“-1”来作为命令源执行1。这种不安全性需要按CVE-2019-14287中演示的结构化设置，但也为未授权用户打开了大门。在命令行中使用 -u -...

EUVD-2026-67963

StorageGRID formerly StorageGRID Webscale versions 11.5 and higher in a non-standard configuration and scenario are susceptible to a Denial of Service vulnerability. Successful exploit could allow an attacker with some control over the environment to cause a partial Denial of Service...

CVE-2026-22056

StorageGRID formerly StorageGRID Webscale versions 11.5 and higher in a non-standard configuration and scenario are susceptible to a Denial of Service vulnerability. Successful exploit could allow an attacker with some control over the environment to cause a partial Denial of Service...

CVE-2026-22056 CVE-2026-22056 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)

StorageGRID formerly StorageGRID Webscale versions 11.5 and higher in a non-standard configuration and scenario are susceptible to a Denial of Service vulnerability. Successful exploit could allow an attacker with some control over the environment to cause a partial Denial of Service...

CVE-2026-22056

StorageGRID (formerly StorageGRID Webscale) versions 11.5 and higher are susceptible to a Denial of Service vulnerability when deployed in a non-standard configuration and scenario. A successful exploit allows an attacker with low privileges and some control over the environment to cause a partia...

Linux Distros Unpatched Vulnerability : CVE-2026-19953

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host...

The vulnerability of the `create_mad_addr_info()` function in the `drivers/infiniband/core/mad.c` file of the Linux operating system’s kernel driver for InfiniBand, which allows a hacker to cause a service failure.

The vulnerability of the createmadaddrinfo function in the drivers/infiniband/core/mad.c file of the Linux operating system’s InfiniBand driver module is related to the use of functions with non-standard implementations. Exploiting this vulnerability could allow an attacker to cause a service...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Fixed a kernel panic that occurred when removing a non-standard SDIO card. The SDIO tuple is only allocated for standard SDIO cards. This can cause memory corruption issues when a non-standard SDIO card is removed. Thi...

joserfc: joserfc: JWT Malleability via Non-Standard Padding

A flaw was found in joserfc, a Python library for JSON Object Signing and Encryption JOSE standards. This vulnerability allows the library to accept JSON Web Tokens JWTs that include non-standard trailing padding. An attacker could exploit this to create malleable JWTs, potentially bypassing...

CVE-2026-15064

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens...

CVE-2026-15064

CVE-2026-15064 affects IBM WebSphere Application Server 9.0, IBM WebSphere Application Server 8.5, and IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.7. The issue is a vulnerability to HTTP Response Smuggling caused by improper handling of non-standard HTTP version tokens. The c...

CVE-2026-15064 IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens...

EUVD-2026-50024

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens...

CVE-2026-15064 IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens...

kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr

In the Linux kernel, the following vulnerability has been resolved: ima: don't clear IMADIGSIG flag when setting or removing non-IMA xattr Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores IMA signature in security.ima and then...

PT-2026-58924

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1 and 8.6.81, the default fileUpload.fileExtensions blocklist could be bypassed by uploading a file with a non-standard or compound extension and dangerous content type, allowing...

CVE-2026-55778 Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.11 and 8.6.81, the default fileUpload.fileExtensions blocklist could be bypassed by uploading a file with a non-standard or compound extension and dangerous content type,...

CVE-2026-55778

Parse Server is affected by a stored XSS vulnerability where the default fileUpload.fileExtensions blocklist can be bypassed using non-standard or compound extensions paired with a dangerous Content-Type. This enables attacker-supplied content to be served by storage adapters (e.g., S3, GCS) and ...

CVE-2026-55778 Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.11 and 8.6.81, the default fileUpload.fileExtensions blocklist could be bypassed by uploading a file with a non-standard or compound extension and dangerous content type,...

PYSEC-2026-1752 opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics

Summary Autoinstrumentation out of the box adds the label httpmethod that has unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. Details HTTP method for requests can be easily set by an attacker to be random and long. PoC Send many...