argumentinjectionhammer

Argument Injection Hammer Argument Injection Hammer는 웹 애플리케이션 및 웹 서비스에서 인수 주입 및 조작 취약점을 탐지하는 스캐너의 기능을 확장하는 인터셉팅 프록시 Burp Suite용 확장 프로그램입니다. 웹 애플리케이션은 신뢰할 수 없는 입력이 외부 명령의 인수로 전달될 때 인수 주입에 취약합니다. 공격자는 프로세스에 전달되는 인수를 조작하여 명령이 지원하는 인수와 명령이 실행되는 방식에 따라 임의 파일 쓰기, 임의 파일 읽기 또는 OS 명령 주입을 트리거할 수 있습니다. 인수 주...

http-request-smuggling

HTTP 요청 스머글링 탐지 도구 HTTP 요청 스머글링은 공격자가 모호한 HTTP 요청을 밀반입하여 보안 제어를 우회하고 무단 액세스 권한을 획득하여 악의적인 활동을 수행하는 높은 심각도의 취약점입니다. 이 취약점은 2005년 watchfire에 의해 발견되었고, 이후 2019년 8월 James Kettle - albinowax에 의해 재발견되어 DEF CON 27과 Black-Hat USA에서 발표되었습니다. 이 취약점에 대해 더 자세히 알고 싶다면 Portswigger 웹사이트에 있는 그의 잘 정리된 연구 블로그를...

AlmaLinux 9.2 [TuxCare] Security Update: libgcrypt / libgcrypt-devel (ALMALINUX9.2:CLSA-2025:1737656427)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1737656427 advisory. - A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a...

AlmaLinux 9.2 [TuxCare] Security Update: libgcrypt / libgcrypt-devel (ALMALINUX9.2:CLSA-2025:1736859209)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1736859209 advisory. - A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a...

CVE-2026-91967: Server-Side Request Forgery (SSRF)

AVideo through 29.0 contains a blind server-side request forgery vulnerability in the getHeaderContentTypeFromURL function that issues getheaders calls guarded only by format validation. Authenticated users with canUpload permission can store attacker-chosen URLs as video links, triggering...

USN-8711-1: Libgcrypt vulnerability

It was discovered that Libgcrypt had a timing-based side-channel flaw in its RSA implementation. A remote attacker could possibly use this issue to obtain sensitive information...

EUVD-2026-52225

PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a...

EUVD-2026-51678

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params:term into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated...

ROS-20260715-73-0003

The vulnerability of the modauthdigest module in the Apache HTTP Server is related to the disclosure of information based on temporal discrepancies. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions remotely...

PT-2026-58852

HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, through careful system control and response time monitoring, to perform some level of user enumeration for the BigFix service...

CVE-2026-44332

Fiber is an Express inspired web framework written in Go. Prior to 3.3.0, the default Authorizer function in the BasicAuth middleware in middleware/basicauth/config.go uses short-circuit evaluation that skips password hash comparison for non-existent usernames, enabling reliable remote username...

Linux Distros Unpatched Vulnerability : CVE-2026-15041

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp for comparing password hashes instead of a...

PYSEC-2026-1331 Timing-Based Username Enumeration Vulnerability in Fides Webserver Authentication

A timing-based username enumeration vulnerability has been identified in Fides Webserver authentication. This vulnerability allows an unauthenticated attacker to determine the existence of valid usernames by analyzing the time it takes for the server to respond to login requests. The discrepancy ...

Timing-Based Username Enumeration Vulnerability in Fides Webserver Authentication

A timing-based username enumeration vulnerability has been identified in Fides Webserver authentication. This vulnerability allows an unauthenticated attacker to determine the existence of valid usernames by analyzing the time it takes for the server to respond to login requests. The discrepancy ...

GHSA-5W46-G9PQ-WH6F Filament: Timing-based user enumeration on login page

The login page has an observable timing discrepancy that allows unauthenticated attackers to enumerate registered email addresses. The impact is limited to disclosing whether an account exists for a given email...

CVE-2026-48166 Filament: Timing-based user enumeration on login page

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, the login page has an observable timing discrepancy that allows unauthenticated attackers to enumerate registered email addresses. The impact is limited to disclosing whether ...

CVE-2026-26379

Koha versions up to 25.11 contain a Server-Side Request Forgery SSRF vulnerability via the Z39.50/SRU server configuration. This allows authenticated attackers to perform internal network scanning and identify running services by analyzing server response times...

AWS libcrypto 安全漏洞

AWS libcrypto is a general-purpose encryption library open sourced by Amazon Web Services. Versions of AWS libcrypto prior to 1.69.0 contained security vulnerabilities. These vulnerabilities stemmed from observable time differences during AES-CCM decryption, which could potentially allow...

CVE-2026-27480 Static Web Server: Timing-Based Username Enumeration in Basic Authentication

Static Web Server SWS is a production-ready web server suitable for static web files or assets. In versions 2.1.0 through 2.40.1, a timing-based username enumeration vulnerability in Basic Authentication allows attackers to identify valid users by exploiting early responses for invalid usernames,...

PT-2026-7914

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.14.1 Description A timing-based user enumeration issue exists in the password reset functionality. Providing an invalid reset url parameter results in differing response times – approximately 500ms – between...