187 matches found
http-request-smuggling
Инструмент обнаружения контрабанды HTTP-запросов HTTP Request Smuggling Контрабанда HTTP-запросов — это уязвимость высокой степени серьезности, представляющая собой технику, при которой злоумышленник провозит неоднозначный HTTP-запрос в обход средств безопасности и получает несанкционированный...
argumentinjectionhammer
Argument Injection Hammer Argument Injection Hammer는 웹 애플리케이션 및 웹 서비스에서 인수 주입 및 조작 취약점을 탐지하는 스캐너의 기능을 확장하는 인터셉팅 프록시 Burp Suite용 확장 프로그램입니다. 웹 애플리케이션은 신뢰할 수 없는 입력이 외부 명령의 인수로 전달될 때 인수 주입에 취약합니다. 공격자는 프로세스에 전달되는 인수를 조작하여 명령이 지원하는 인수와 명령이 실행되는 방식에 따라 임의 파일 쓰기, 임의 파일 읽기 또는 OS 명령 주입을 트리거할 수 있습니다. 인수 주...
EUVD-2026-52225
PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a...
ROS-20260715-73-0003
The vulnerability of the modauthdigest module in the Apache HTTP Server is related to the disclosure of information based on temporal discrepancies. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions remotely...
CVE-2026-44332
Fiber is an Express inspired web framework written in Go. Prior to 3.3.0, the default Authorizer function in the BasicAuth middleware in middleware/basicauth/config.go uses short-circuit evaluation that skips password hash comparison for non-existent usernames, enabling reliable remote username...
Linux Distros Unpatched Vulnerability : CVE-2026-15041
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp for comparing password hashes instead of a...
PYSEC-2026-1331 Timing-Based Username Enumeration Vulnerability in Fides Webserver Authentication
A timing-based username enumeration vulnerability has been identified in Fides Webserver authentication. This vulnerability allows an unauthenticated attacker to determine the existence of valid usernames by analyzing the time it takes for the server to respond to login requests. The discrepancy ...
GHSA-5W46-G9PQ-WH6F Filament: Timing-based user enumeration on login page
The login page has an observable timing discrepancy that allows unauthenticated attackers to enumerate registered email addresses. The impact is limited to disclosing whether an account exists for a given email...
CVE-2026-48166 Filament: Timing-based user enumeration on login page
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, the login page has an observable timing discrepancy that allows unauthenticated attackers to enumerate registered email addresses. The impact is limited to disclosing whether ...
CVE-2026-26379
Koha versions up to 25.11 contain a Server-Side Request Forgery SSRF vulnerability via the Z39.50/SRU server configuration. This allows authenticated attackers to perform internal network scanning and identify running services by analyzing server response times...
AWS libcrypto 安全漏洞
AWS libcrypto is a general-purpose encryption library open sourced by Amazon Web Services. Versions of AWS libcrypto prior to 1.69.0 contained security vulnerabilities. These vulnerabilities stemmed from observable time differences during AES-CCM decryption, which could potentially allow...
CVE-2026-27480 Static Web Server: Timing-Based Username Enumeration in Basic Authentication
Static Web Server SWS is a production-ready web server suitable for static web files or assets. In versions 2.1.0 through 2.40.1, a timing-based username enumeration vulnerability in Basic Authentication allows attackers to identify valid users by exploiting early responses for invalid usernames,...
PT-2026-7914
Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.14.1 Description A timing-based user enumeration issue exists in the password reset functionality. Providing an invalid reset url parameter results in differing response times – approximately 500ms – between...
AMD GPU Timing-Based Side Channels
Revisions Revision Date| Description ---|--- 2026-02-10| Initial publication...
Timing-Based Side-Channel Attack
github.com/mattermost/mattermost-server is vulnerable to timing-based side-channel attacks. The vulnerability is due to improper use of constant-time comparison for sensitive strings, which allows an attacker to exploit timing oracles to perform byte-by-byte brute-force attacks on Cloud API keys...
EUVD-2023-38005
Malicious code in bioql PyPI...
EUVD-2023-36586
Malicious code in bioql PyPI...
EUVD-2024-27192
Malicious code in bioql PyPI...