141202 matches found
CVE-2026-105223 maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification
maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig and parseKubeconfigFile when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer token...
cve-2022-24785-poc-lab
ๆฆ่ฟฐ ่ฟๆฏไธไธช็ฎๅ็ Node Express ๅบ็จ๏ผ็จไบๆข็ดข Moment.js ็่ทฏๅพ้ๅๆผๆด๏ผCVE-2022-24785๏ผใ ๅฎ่ฃ git clone https://github.com/pS3ud0RAnD0m/momentjs.git cd momentjs cat package.json Change 'moment' to '2.29.4' if wanting to test bypasses of the current patch. npm install node app.js...
EUVD-2026-92135
The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets sslverifypeer to FALSE, which is passed to CURLOPTSSLVERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests...
EUVD-2026-92134
The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because httpconnection in lib/gist.rb sets VERIFYNONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens...
CVE-2026-105174 Gerapy Project Management views.py project_create path traversal
A vulnerability has been found in Gerapy up to 0.9.13. This vulnerability affects the function projectcreate of the file gerapy/server/core/views.py of the component Project Management. The manipulation of the argument projectname leads to path traversal. Remote exploitation of the attack is...
CVE-2026-105174
A path traversal vulnerability exists in Gerapy up to version 0.9.13 within the Project Management component. The issue is located in the project_create function of the gerapy/server/core/views.py file, where improper handling of the project_name argument allows for unauthorized directory access....
CVE-2026-105174 Gerapy Project Management views.py project_create path traversal
A vulnerability has been found in Gerapy up to 0.9.13. This vulnerability affects the function projectcreate of the file gerapy/server/core/views.py of the component Project Management. The manipulation of the argument projectname leads to path traversal. Remote exploitation of the attack is...
EUVD-2026-92154
A vulnerability has been found in Gerapy up to 0.9.13. This vulnerability affects the function projectcreate of the file gerapy/server/core/views.py of the component Project Management. The manipulation of the argument projectname leads to path traversal. Remote exploitation of the attack is...
CVE-2026-105174 Gerapy Project Management views.py project_create path traversal
A vulnerability has been found in Gerapy up to 0.9.13. This vulnerability affects the function projectcreate of the file gerapy/server/core/views.py of the component Project Management. The manipulation of the argument projectname leads to path traversal. Remote exploitation of the attack is...
CVE-2021-41773
CVE-2021-41773 - Apache HTTP Server 2.4.49 CVE-2021-41773-Path Traversal ใฉใใฎๅฎ่กๆนๆณ 1. PC/ใใผใใใฝใณใณใซ Docker ใใคใณในใใผใซใใฆๅฎ่กใใพใ 2. ใใฎ GitHub ใชใใธใใชใใฏใญใผใณใใพใ 3. Path Traversal ใใฉใซใใซ็งปๅใใพใ 4. ไปฅไธใฎใณใใณใใๅ ฅๅใใพใ docker build -t cve-2021-41773-path-traversal . ใใใณ docker run --rm -dit -p 8888:80...
CVE-2025-6218-WinRAR-RCE-POC
CVE-2025-6218: WinRAR ใในใใฉใใผใตใซ RCE โ ๏ธ ้ๅคงใช่ๅผฑๆง - ็ฉๆฅต็ใชๆช็จใ็ขบ่ชใใใพใใ CVE-2025-6218 ใฏใWinRAR ใซใใใใในใใฉใใผใตใซใฎๆทฑๅปใช่ๅผฑๆงใงใไปปๆใฎใณใผใๅฎ่กใๅฏ่ฝใซใใพใใ็พๅจใAPT ใฐใซใผใ ๏ผGOFFEEใBitter๏ผAPT-C-08๏ผใGamaredon ใชใฉ๏ผใซใใฃใฆๆช็จใใใฆใใพใใ ๐ ็ฎๆฌก ๆฆ่ฆ ๆ่ก็่ชฌๆ ใจใฏในใใญใคใใฎไป็ตใฟ ๅฝฑ้ฟใๅใใใใผใธใงใณ ๆปๆใทใใชใช ่ ๅจใขใฏใฟใผ ๆฆๅฟตๅฎ่จผ ๆคๅบใจIOC ็ทฉๅ็ญ ใฟใคใ ใฉใคใณ ใชใใธใใชๆงๆ ๅ่ๆ ๅ ฑ ๐ฏ ๆฆ่ฆ CVE-2025-6218...
CVE-2026-105676: Improper Limitation of a Pathname to a Restricted Directory
Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. This issue is...
The vulnerability of the extra/mariabackup/xbstream.cc file of the MariaDB database management system allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the extra/mariabackup/xbstream.cc file of the MariaDB database management system is related to an incorrect limitation on the path name for the restricted access directory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...
CVE-2026-105766: Cleartext Transmission of Sensitive Information
Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy edu from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0e50739c225f5aee2e803800a47fc0feb906 allows an on-path network attacker to read or modify documentatio...
MikroTik RouterOS Path Traversal (CVE-2026-67281)
RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file- serving path dereferences...
MikroTik RouterOS Argument Injection (CVE-2026-86060)
RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS...
Cisco ASA Path Traversal (CVE-2020-3187)
A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files on a targeted...
PT-2026-105994
DropzoneFileExplorer chunked upload trusts fileName all the way to fopen!! CVE-2026-104826 CVSS 8.5. v1.1. Traversal walks out of the storage root into the web root. PHP runs. Auth required unless AUTH ENABLE=false. CVE assigned 2 Oct. Fixed in v1.2. PoC dropped 3 Oct!! https://t.co/rrzsvshNEK...
CVE-2026-89039: Improper Limitation of a Pathname to a Restricted Directory
A caller who can invoke the convertplaywrightscript prompt in mcp-k6 can pass a bare file path as the playwrightscript argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user's home directory path traversal. The...
CVE-2026-105683: Path Traversal: '.../...//'
Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. This issue is fixed in version 6.27.0...