790 matches found
Mitel ShoreTel 19.46.1802.0 Devices - Cross-Site Scripting
Mitel ShoreTel 19.46.1802.0 devices and their conference component are vulnerable to an unauthenticated attacker conducting reflected cross-site scripting attacks via the PATHINFO variable to index.php due to insufficient validation for the timezone object in the HOMEMEETING& page. id:...
CVE-2019-11043
CVE-2019-11043 漏洞描述 NgiNginx 上 fastcgisplitpathinfo 在处理带有 %0a 的请求时，会因为遇到换行符 \n 导致 PATHINFO 为空。而 php-fpm 在处理 PATHINFO 为空的情况下，存在逻辑缺陷。攻击者通过精心的构造和利用，可以导致远程代码执行。 nx 上 fastcgisplitpathinfo 在处理带有 %0a 的请求时，会因为遇到换行符 \n 导致 PATHINFO 为空。而 php-fpm 在处理 PATHINFO 为空的情况下，存在逻辑缺陷。攻击者通过精心的构造和利用，可以导致远程代码执行。 影响范围 Ngin...
CVE-2020-28351
ShoreTel 19.46.1802.0 Reflected Cross Site Scripting Attack The conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a reflected cross-site scripting attack XSS via the PATHINFO to index.php, due to insufficient validation for the timezo...
CVE-2019-11043
CVE-2019-11043 0th3rs Security Team ====================== En las versiones de PHP 7.1.x anteriores a 7.1.33, 7.2.x anteriores a 7.2.24 y 7.3.x anteriores a 7.3.11 Probado con PHP 7.2.20/7.3.10 Instrucciones root@kitploit: 1. Relativamente estable, siempre que se obtenga por fuerza bruta la...
cve-2019-11043
Vulnerabilidad de ejecución remota de código en PHP CVE-2019-11043 1. Antecedentes El 26 de septiembre, PHP publicó un aviso oficial de vulnerabilidad, en el que señaló que los servidores que usan Nginx + php-fpm, bajo ciertas configuraciones, presentan una vulnerabilidad de ejecución remota de...
PHP-FPM-Remote-Code-Execution-Vulnerability-CVE-2019-11043-
CVE-2019-11043 1. Descripción de la vulnerabilidad Cuando Nginx maneja fastcgisplitpathinfo con solicitudes que contienen %0a, debido al salto de línea \n, PATHINFO se vuelve vacío. Y php-fpm tiene un defecto lógico al manejar PATHINFO vacío. Un atacante puede provocar una ejecución remota de...
PHP-FPM Path Info Buffer Underflow - Remote Code Execution
In PHP-FPM before 7.1.33, 7.2.x before 7.2.24, and 7.3.x before 7.3.11, when deployed in certain Nginx configurations with the fastcgisplitpathinfo directive, a crafted request with an empty PATHINFO can trigger a buffer underflow in the php-fpm code. This may allow an unauthenticated remote...
CVE-2026-75922
Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATHINFO written unencoded to the upstream request line. PSGI hands PATHINFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it...
CVE-2026-75922
Reverse::Proxy (CPAN module by LNATION) versions before 0.04 for Perl are vulnerable to HTTP request smuggling via a percent-decoded PATH_INFO written unencoded into the upstream request line. Because PSGI delivers PATH_INFO already decoded, a client-controlled %0d%0a in the URL becomes a raw CRL...
EUVD-2026-64662
Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATHINFO written unencoded to the upstream request line. PSGI hands PATHINFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it...
CVE-2026-75922 Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line
Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATHINFO written unencoded to the upstream request line. PSGI hands PATHINFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it...
SUSE CVE-2026-27590
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because...
CVE-2026-27590
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because...
GO-2026-4486 FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP in github.com/dunglas/frankenphp
FrankenPHP's unicode case-folding length expansion causes incorrect splitpath index SCRIPTNAME/PATHINFO confusion in FrankenPHP in github.com/dunglas/frankenphp...
CVE-2019-20515
ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the addresses/ URI...
CVE-2019-20521
ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the api/ URI...
CVE-2019-20516
ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the blog/ URI...
CVE-2019-16657
TuziCMS 2.0.6 has XSS via the PATHINFO to a group URI, as demonstrated by index.php/article/group/id/2/...