10 matches found
CVE-2025-10951
CVE-2025-10951 - checkmlloggertraversal.py Proof-of-existence checker for CVE-2025-10951 / GHSA-8x9j-2p8r-7xc6 — an unauthenticated path traversal in geyang/ml-logger ≤ 0.10.36, affecting the loghandler / streamhandler functions in mllogger/server.py. For use only against systems you are authoriz...
CVE-2026-109427
Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encodestring/decodestring functions. Attackers can craft or enumerate...
EUVD-2026-97859
Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encodestring/decodestring functions. Attackers can craft or enumerate...
CVE-2026-109427 Telegram-Stremio 5.1.0 Broken Object Authorization via Stream IDs
Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encodestring/decodestring functions. Attackers can craft or enumerate...
CVE-2026-109427
Telegram-Stremio versions through 5.1.0 are affected by a broken object-level authorization vulnerability. The root cause is the use of encode_string and decode_string functions to process unsigned, unauthenticated stream IDs. Authenticated token holders can exploit this by crafting or enumeratin...
CVE-2026-109427: Authorization Bypass Through User-Controlled Key
Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encodestring/decodestring functions. Attackers can craft or enumerate...
Exploit for CVE-2025-10952
CVE-2025-10952 — ml-logger streamhandler Arbitrary File Rea...
Exploit for CVE-2025-10951
CVE-2025-10951 - checkmlloggertraversal.py Proof-of-existen...
CVE-2025-10952
A security flaw has been discovered in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected by this issue is the function streamhandler of the file mllogger/server.py of the component File Handler. Performing manipulation of the argument key results in information disclosure...
CVE-2025-10952: Exposure of Sensitive Information to an Unauthorized Actor
A security flaw has been discovered in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected by this issue is the function streamhandler of the file mllogger/server.py of the component File Handler. Performing manipulation of the argument key results in information disclosure...