Lucene search
+L

211 matches found

Kitploit
Kitploit
added 2026/09/07 7:30 p.m.6 views

CVE-2026-20896

CVE-2026-20896 Gitea의 공식 Docker 이미지1.26.2까지는 기본 설정으로 REVERSEPROXYTRUSTEDPROXIES = 를 포함하고 있습니다. 리버스 프록시 로그인을 활성화하면 와일드카드로 인해 모든 소스 IP가 신뢰되는 프록시로 간주되어, 해당 포트에 접근 가능한 누구나 X-WEBAUTH-USER 헤더를 보내 원하는 사용자로 로그인할 수 있습니다. 비밀번호나 토큰이 필요 없습니다. 이 문제를 Gitea에 보고했으며, 1.26.3 / 1.26.4에서 수정되었습니다. 이 저장소는 제가 직접 작성한 분석...

9.8CVSS8.2AI score0.02755EPSS
SaveExploits7References1
RedhatCVE
RedhatCVE
added 2026/09/01 8:40 a.m.7 views

CVE-2026-42395

A flaw was found in Dovecot. A remote attacker, if able to send forwarding information from a host configured as a trusted proxy, could send a NUL byte that crashes the login process. This termination of the login process can lead to a denial of service for user logins. Mitigation To mitigate thi...

6.5CVSS7.1AI score0.00181EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/09/01 8:40 a.m.8 views

CVE-2026-42008

A flaw was found in Dovecot. Forwarded information from a host listed as a trusted proxy is not properly separated from Dovecot's internal authentication fields. This allows a malicious host configured as a trusted proxy to inject values as internal authentication fields, enabling it to...

4.3CVSS5.7AI score0.00193EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/09/01 12:00 a.m.9 views

PT-2026-84535

Name of the Vulnerable Software and Affected Versions AVideo affected versions not specified Description AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers. This allows attackers to spoof the client address used by the enforceRateLimit function. By...

8.7CVSS5.2AI score0.00261EPSS
SaveExploits0References6
Tenable Nessus
Tenable Nessus
added 2026/08/29 12:00 a.m.15 views

Linux Distros Unpatched Vulnerability : CVE-2026-42008

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that hos...

4.3CVSS7.1AI score0.00193EPSS
SaveExploits0References4
Tenable Nessus
Tenable Nessus
added 2026/08/29 12:00 a.m.14 views

Linux Distros Unpatched Vulnerability : CVE-2026-42395

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The logi...

4.3CVSS7.2AI score0.00181EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/28 12:16 p.m.6 views

AZL-98265 CVE-2026-42395 affecting package dovecot 2.3.20-1

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...

4.3CVSS7.1AI score0.00181EPSS
SaveExploits0References1
OSV
OSV
added 2026/08/28 12:16 p.m.9 views

ALPINE-CVE-2026-42395

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...

4.3CVSS7.1AI score0.00181EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/28 12:16 p.m.10 views

CVE-2026-42008

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...

4.3CVSS0.00193EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/28 12:16 p.m.9 views

CVE-2026-42395

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...

4.3CVSS0.00181EPSS
SaveExploits0References1
OSV
OSV
added 2026/08/28 12:16 p.m.8 views

AZL-98325 CVE-2026-42008 affecting package dovecot 2.3.20-1

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...

4.3CVSS5.8AI score0.00193EPSS
SaveExploits0References1
AlpineLinux
AlpineLinux
added 2026/08/28 10:12 a.m.11 views

CVE-2026-42395

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...

4.3CVSS5.9AI score0.00181EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2026/08/28 10:12 a.m.13 views

CVE-2026-42395

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...

4.3CVSS5.9AI score0.00181EPSS
SaveExploits0
CVE
CVE
added 2026/08/28 10:12 a.m.27 views

CVE-2026-42395

CVE-2026-42395 affects Dovecot (OX Dovecot by Open-Xchange, per the advisory reference). A host listed as a trusted proxy can send forwarding information containing a NUL byte , which crashes the login process on the next login attempt, causing degradation or denial of service for logins. Deploym...

4.3CVSS5.9AI score0.00181EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/28 10:12 a.m.33 views

CVE-2026-42395

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...

4.3CVSS0.00181EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/28 10:12 a.m.11 views

EUVD-2026-67677

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...

4.3CVSS5.9AI score0.00181EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/28 10:12 a.m.12 views

EUVD-2026-67673

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...

4.3CVSS5.8AI score0.00193EPSS
SaveExploits0References1
Debian CVE
Debian CVE
added 2026/08/28 10:12 a.m.15 views

CVE-2026-42008

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...

4.3CVSS5.8AI score0.00193EPSS
SaveExploits0
Cvelist
Cvelist
added 2026/08/28 10:12 a.m.36 views

CVE-2026-42008

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...

4.3CVSS0.00193EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/28 10:12 a.m.27 views

CVE-2026-42008

CVE-2026-42008 is an authentication bypass in Dovecot (Open-Xchange fork) where forwarding information from a trusted proxy host is not kept separate from Dovecot's own authentication fields. A malicious or compromised trusted proxy host can inject an internal authentication field, allowing it to...

4.3CVSS5.8AI score0.00193EPSS
SaveExploits0References1
Rows per page
Query Builder