338 matches found
CVE-2014-0094
CVE-2014-0094 For verification. Refer to https://piyolog.hatenadiary.jp/entry/20140417/1397750197, vulhub/java:7u55-jdk tomcat-8.0.5 struts-2.3.16 reproduced. The classLoader is working, but the crucial log is percent-encoded, so it does not lead to RCE Windows version also added but only 7u191...
CVE-2021-41773
CVE-2021-41773 — Apache HTTP Server 2.4.49 Path Traversal & RCE ⚠️ For isolated, educational lab use ONLY. This repository builds a deliberately vulnerable Apache server. Never run it on a live, production, or internet-facing host. Red Team internship project by Team Alpha ITSOLERA — Offensive...
CVE-2026-109118
Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence %2e%2e in the request path, because the...
CVE-2026-109118 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb
Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence %2e%2e in the request path, because the...
EUVD-2026-102835
Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence %2e%2e in the request path, because the...
CVE-2026-109118
The ikus060 rdiffweb 7.1.1 software contains a Path Traversal vulnerability (CWE-22) due to an improper path containment check. An authenticated user can use a percent-encoded traversal sequence (%2e%2e) in the request path to cause browse, restore, history, and delete operations to resolve to pa...
GHSA-2VC4-C4R6-P6V6 OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths
Summary When cache interception is enabled, @opennextjs/cloudflare can interpret percent-encoded paths differently during middleware matching and cache lookup. An encoded request may fail to match authorization middleware, then be decoded into the cache key of a protected route. The cached respon...
CVE-2026-100409
OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cach...
CVE-2026-100409 OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths
OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cach...
EUVD-2026-102200
OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cach...
PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters
SummaryPyMongo percent-decoded the entire host section of a connection string before splitting it into individual host:port entries. A percent-encoded , or : in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client's seed list...
PYSEC-2026-4297 PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters
Summary PyMongo percent-decoded the entire host section of a connection string before splitting it into individual host:port entries. A percent-encoded , or : in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client's seed list...
Contao: Path traversal in the images controller
ImagesController joins the user controlled path onto the configured image target directory with Path::join, which canonicalises .. segments, and never calls Path::isBasePath to confirm the result stayed inside that directory. An unauthenticated GET with percent encoded dot segments therefore...
CVE-2026-107334
Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...
CVE-2026-107334
The Malcolm software contains an Incorrect Authorization vulnerability in its nginx Lua role-based access control (RBAC) layer. The issue arises because the Lua RBAC layer performs pattern-matching on the raw, percent-encoded request URI , while Nginx selects location blocks using the percent-dec...
PT-2026-108103
Name of the Vulnerable Software and Affected Versions Malcolm affected versions not specified Description The nginx Lua role-based access control RBAC layer fails to percent-decode the request URI before performing pattern-matching to restrict access to sensitive paths. While the RBAC gate...
CVE-2026-107334: Incorrect Authorization
Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...
GHSA-VP6J-J7W5-5XJJ PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters
Summary PyMongo percent-decoded the entire host section of a connection string before splitting it into individual host:port entries. A percent-encoded , or : in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client's seed list...
PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters
Summary PyMongo percent-decoded the entire host section of a connection string before splitting it into individual host:port entries. A percent-encoded , or : in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client's seed list...