http-request-smuggling

HTTPリクエストスマグリング検出ツール HTTPリクエストスマグリングは、攻撃者が曖昧なHTTPリクエストを密輸してセキュリティ制御をバイパスし、不正アクセスを取得して悪意のある活動を実行する手法であり、深刻度の高い脆弱性です。この脆弱性は2005年にwatchfireによって発見され、その後2019年8月にJames Kettle - albinowaxによって再発見され、DEF CON 27およびBlack-Hat...

argumentinjectionhammer

Argument Injection Hammer Argument Injection Hammer 是拦截代理 Burp Suite 的一个扩展，用于扩展扫描器检测 Web 应用和 Web 服务中参数注入与参数操纵漏洞的能力。 当不受信任的输入被作为参数传递给外部命令时，Web 应用就存在参数注入漏洞。攻击者可以操纵传递给进程的参数，根据命令支持的参数以及命令的执行方式，触发任意文件写入、任意文件读取或 OS 命令注入。参数注入不应与 OS 命令注入相混淆，后者可以利用 shell 元字符强制目标应用执行额外的任意 OS 命令。 该扩展包含可检测常见 Linux...

AlmaLinux 9.2 [TuxCare] Security Update: libgcrypt / libgcrypt-devel (ALMALINUX9.2:CLSA-2025:1737656427)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1737656427 advisory. - A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a...

AlmaLinux 9.2 [TuxCare] Security Update: libgcrypt / libgcrypt-devel (ALMALINUX9.2:CLSA-2025:1736859209)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1736859209 advisory. - A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a...

CVE-2026-91967: Server-Side Request Forgery (SSRF)

AVideo through 29.0 contains a blind server-side request forgery vulnerability in the getHeaderContentTypeFromURL function that issues getheaders calls guarded only by format validation. Authenticated users with canUpload permission can store attacker-chosen URLs as video links, triggering...

USN-8711-1: Libgcrypt vulnerability

It was discovered that Libgcrypt had a timing-based side-channel flaw in its RSA implementation. A remote attacker could possibly use this issue to obtain sensitive information...

EUVD-2026-52225

PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a...

EUVD-2026-51678

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params:term into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated...

ROS-20260715-73-0003

The vulnerability of the modauthdigest module in the Apache HTTP Server is related to the disclosure of information based on temporal discrepancies. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions remotely...

PT-2026-58852

HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, through careful system control and response time monitoring, to perform some level of user enumeration for the BigFix service...

CVE-2026-44332

Fiber is an Express inspired web framework written in Go. Prior to 3.3.0, the default Authorizer function in the BasicAuth middleware in middleware/basicauth/config.go uses short-circuit evaluation that skips password hash comparison for non-existent usernames, enabling reliable remote username...

Linux Distros Unpatched Vulnerability : CVE-2026-15041

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp for comparing password hashes instead of a...

Timing-Based Username Enumeration Vulnerability in Fides Webserver Authentication

A timing-based username enumeration vulnerability has been identified in Fides Webserver authentication. This vulnerability allows an unauthenticated attacker to determine the existence of valid usernames by analyzing the time it takes for the server to respond to login requests. The discrepancy ...

PYSEC-2026-1331 Timing-Based Username Enumeration Vulnerability in Fides Webserver Authentication

A timing-based username enumeration vulnerability has been identified in Fides Webserver authentication. This vulnerability allows an unauthenticated attacker to determine the existence of valid usernames by analyzing the time it takes for the server to respond to login requests. The discrepancy ...

GHSA-5W46-G9PQ-WH6F Filament: Timing-based user enumeration on login page

The login page has an observable timing discrepancy that allows unauthenticated attackers to enumerate registered email addresses. The impact is limited to disclosing whether an account exists for a given email...

CVE-2026-48166 Filament: Timing-based user enumeration on login page

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, the login page has an observable timing discrepancy that allows unauthenticated attackers to enumerate registered email addresses. The impact is limited to disclosing whether ...

CVE-2026-26379

Koha versions up to 25.11 contain a Server-Side Request Forgery SSRF vulnerability via the Z39.50/SRU server configuration. This allows authenticated attackers to perform internal network scanning and identify running services by analyzing server response times...

AWS libcrypto 安全漏洞

AWS libcrypto is a general-purpose encryption library open sourced by Amazon Web Services. Versions of AWS libcrypto prior to 1.69.0 contained security vulnerabilities. These vulnerabilities stemmed from observable time differences during AES-CCM decryption, which could potentially allow...

CVE-2026-27480 Static Web Server: Timing-Based Username Enumeration in Basic Authentication

Static Web Server SWS is a production-ready web server suitable for static web files or assets. In versions 2.1.0 through 2.40.1, a timing-based username enumeration vulnerability in Basic Authentication allows attackers to identify valid users by exploiting early responses for invalid usernames,...

PT-2026-7914

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.14.1 Description A timing-based user enumeration issue exists in the password reset functionality. Providing an invalid reset url parameter results in differing response times – approximately 500ms – between...