Eclipse Jetty - Information Disclosure

Eclipse Jetty 9.4.37-9.4.42, 10.0.1-10.0.5 and 11.0.1-11.0.5 are susceptible to improper authorization. URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. An attacker can potentially obtain sensitive informatio...

Blackash-CVE-2025-61884

CVE-2025-61884 Nuovo bug di Oracle E-Business Suite potrebbe consentire agli hacker di accedere ai dati senza login 💀 CVE-2025-61884 — Riepilogo completo 🧾💥...

CVE-2024-56433

CVE-2024-56433 shadow-utils – Unsichere Standardzuweisung von Subordinations-IDs für lokale Benutzer Zusammenfassung Die standardmäßige Zuweisung von Subordinations-IDs birgt das Risiko einer Kollision mit vorhandenen Benutzer-IDs, was potenziell eine willkürliche Änderung von UID/GID und...

CVE-2021-45232

Apache APISIX Dashboard Schnittstelle ohne Autorisierung Beschreibung Dieses Tool integriert fofa- und POC-Ein-Klick-Erkennungsfunktionen und realisiert das Ein-Klick-Crawlen von fofa sowie die Ein-Klick-Erkennung gleichzeitiges Crawlen und Testen Verwendungsmethode Verwendete Version: python3 Vo...

CVE-2023-49339

Relatório de Vulnerabilidade de Segurança CVE-2023-49339: Sistema Banner da Ellucian Introdução Este documento descreve uma vulnerabilidade de segurança crítica encontrada no Sistema Banner da Ellucian, particularmente na versão 9.17 e versões anteriores. A vulnerabilidade foi identificada em...

PT-2026-82789

Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access or modify sensitive device settings. This could result in full compromise of device functionality...

PT-2026-82736

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different...

PT-2026-82781

A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web management interface does not adequately protect sensitive communications using transport-layer encryption. An attacker with access to network traffic could intercept authentication o...

open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket

A flaw was found in open-iscsi. An incorrect authorization vulnerability allows unprivileged local users to bypass authentication for the iscsiuio control socket. This enables unauthorized access to the control socket, potentially leading to system compromise or disruption of iSCSI Internet Small...

CVE-2023-23752

CVE-2023-23752 Descrição Este repositório contém scripts Python e Bash que servem como portas do Proof of Concept PoC original escrito em Ruby para a vulnerabilidade CVE-2023-23752 no Joomla! CMS versões 4.0.0 a 4.2.7 feito por 'noraj' Alexandre ZANNI. Foi identificada uma falha de controle de...

cve-2018-10933

CVE-2018-10933 CVE-2018-10933 bypass dell'autenticazione libssh, un container Docker vulnerabile che resta in ascolto sulla porta 2222 per lo sfruttamento. Nel container è inclusa una patch proof-of-concept di base per libssh che bypassa l'autenticazione. Per accedere usare le credenziali...

CVE-2022-40684

CVE-2022-40684 CVE-2022-40684 - 认证绕过 运行漏洞利用 root@kitploit: 用法: python3 exploit.py ⣀⡠⢤⡀⠀⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⡴⠟⠃⠀⠀⠙⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⠋⠀⠀⠀⠀⠀⠀⠘⣆⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢠⠾⢛⠒⠀⠀⠀⠀⠀⠀⠀⢸⡆⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣿⣶⣄⡈⠓⢄⠠⡀⠀⠀⠀⣄⣷⠀⠀⠀⠀⠀⠀⠀...

CVE-2026-77507

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply the permission checks used elsewhere, allowing unauthorized users to read change-history metadata from private projects and...

CVE-2020-1938

Dichiarazione: L'uso di tutti gli strumenti di cybersecurity deve essere conforme alle leggi e ai regolamenti nazionali, agli standard di settore e alle regole del sistema target. Non deve essere utilizzato per scopi illegali o che violano i diritti legittimi di altri. Gli utenti devono essere...

CVE-2026-77507 Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply the permission checks used elsewhere, allowing unauthorized users to read change-history metadata from private projects and...

CVE-2026-79938

Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-55228

Weblate versions prior to 2026.7 contain a WebIDOR (Insecure Direct Object Reference) vulnerability in the GroupViewSet REST API endpoint. The API did not properly enforce the scope of project- and workspace-scoped teams, allowing an authenticated user with project-manager privileges to submit un...

CVE-2026-55228 Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforce the scope of project- and workspace-scoped teams, allowing a user to submit invalid team configurations through the API. By assigning...

CVE-2026-55228 Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforce the scope of project- and workspace-scoped teams, allowing a user to submit invalid team configurations through the API. By assigning...

EUVD-2026-66707

Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...