CVE-2025-11187

CVE-2025-11187 Stack buffer overflow in PKCS12 PBMAC1 PBKDF2 keylength OpenSSL 3.X Ho trovato questo stack buffer overflow circa un anno fa, si è rivelato un duplicato CVE-2025-11187 Il problema si verifica nella gestione di PKCS PBMAC1 di libcrypto quando il keylength di PBKDF2 è controllato...

CVE-2026-77078 multer vulnerable to Denial of Service via crafted multipart field names

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError Invalid array length that terminates the Node.js process. The first field uses a very large numeric array index to...

CVE-2026-77078

multer , a popular Node.js middleware for handling multipart/form-data, is vulnerable to a remote denial-of-service in all versions before 2.3.0 . A small multipart request containing two specially crafted text field names triggers an uncaught RangeError (Invalid array length) : the first field a...

CVE-2026-77037 multer vulnerable to Denial of Service via file descriptor leak on aborted uploads

multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a delete...

CVE-2026-77037

multer is a Node.js middleware for handling multipart/form-data uploads. In version 2.2.0 , when a disk-backed upload is aborted or truncated before the write stream finishes, the disk storage engine removes the visible file but fails to close the underlying write file descriptor , leaving a dele...

isf

Industrial Exploitation Framework ISFIndustrial Exploitation Framework is a exploitation framework based on Python, it's similar to metasploit framework. ISF is based on open source project routersploit. Read this in other languages:English, 简体中文, Disclaimer Usage of ISF for attacking targets...

CVE-2025-67445

Panoramica Una vulnerabilità nell'interfaccia di gestione web del TOTOLINK X5000R V9.1.0cu.2415 consente a un attaccante remoto non autenticato sulla LAN di crashare il servizio web tramite un segmentation fault. Inviando una richiesta HTTP POST di dimensioni eccessive all'endpoint CGI, un...

CVE-2026-55484

ALOS HTTP , a Linux-first Go web framework with a custom networking stack, is vulnerable to an unauthenticated remote denial-of-service . The root cause is an unchecked p[0] access in core/utils.go::sanitizeRequestPath after splitPathQuery processes a path beginning with a question mark, leaving ...

CVE-2026-64849

CVE-2026-64849 Mais root@kitploit: POST /api/2.0/mlflow/webhooks HTTP/1.1 Host: Content-Type: application/json "url": "https://httpbin.org/redirect-to?url=http://169.254.169.254/latest/meta-data/", "name": "poc", "events": "action": "CREATED", "entity": "REGISTEREDMODEL" root@kitploit: POST...

CVE-2023-44487

HTTP/2 Rapid Reset: CVE-2023-44487 Beschreibung Dieses Repository enthält Proof-of-Concept-Code PoC für die HTTP/2-Rapid-Reset-Schwachstelle, die als CVE-2023-44487 identifiziert wurde. Überblick über die Schwachstelle CVE-ID : CVE-2023-44487 Auswirkung : Denial of Service DoS Betroffene Protokol...

plone.app.event vulnerable to denial of service via iCalendar import

Impact By abusing the iCalendar import functionality, a logged-in editor could take the whole site offline, make the server reach into the internal network and read calendar files off disk SSRF, and store XSS. Patches The problem has been patched in plone.app.event. For Plone 6.2: upgrade to...

CVE-2026-55247 plone.app.event: Denial of service via iCalendar import

plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per...

EUVD-2026-67868

plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per...

CVE-2026-55247

plone.app.event , Plone's event content type, contains multiple issues in its iCalendar import (src/plone/app/event/ical/importer.py) prior to versions 5.2.4 and 6.0.1 . The importer accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported ...

CVE-2026-55247 plone.app.event: Denial of service via iCalendar import

plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per...

CVE-2019-1064

CVE-2019-1064 - AppXSVC Lokale Berechtigungserhöhung https://www.rythmstick.net/posts/cve-2019-1064/...

FTP-vsFTPD-CVE-2011-2523-VAPT-Report

REPORT VAPT vsFTPD CVE-2011-2523 Target: Metasploitable 2 Tester: Analista di Sicurezza Data: 24 giugno 2026 Ambito: Test interno di laboratorio Kali Linux → Metasploitable 2 📌Sommario Esecutivo È stata eseguita una scansione delle vulnerabilità utilizzando lo script di scansione delle...

CVE-2026-55520

Protego is a pure-Python robots.txt parser. Prior to 0.6.2 , the _URLPattern._prepare_pattern_for_regex method in src/protego/_urlpattern.py translates every asterisk in an Allow or Disallow directive into a lazy regex wildcard. A directive containing many asterisks triggers exponential backtrack...

CVE-2026-55520 Protego: Exponential backtracking ReDoS in robots.txt URL wildcard matching

Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego.urlpattern.URLPattern.preparepatternforregex translates every asterisk in an Allow or Disallow directive into a lazy regular-expression wildcard, so a directive containing many asterisks create...

plone.app.portlets vulnerable to denial of service via RSS feed portlet

Impact By adding an RSS portlet, and giving this a link to a very large file, a member can cause a denial of service attack, because Plone will use lots of memory. The member could also use different urls to try to get information about the internal network and open port numbers SSRF. A malicious...