85 matches found
vCenter Server - Improper Access Control
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed. id: CVE-2021-22017 info: name:...
EUVD-2026-64772
fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For...
CVE-2026-63177 Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized ngx.var.requesturi, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can...
CVE-2026-63177
What is affected: Malcolm (network traffic analysis tool suite). The issue is in the Nginx OpenResty Lua RBAC layer prior to v26.07.0, where RBAC evaluates the unnormalized ngx.var.request_uri while Nginx routes on the normalized path. Root cause: URI normalization mismatch allows a low-privilege...
CVE-2026-63177 Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized ngx.var.requesturi, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can...
CVE-2026-63177 Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized ngx.var.requesturi, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can...
keycloak-services: keycloak-services: Authorization bypass via unnormalized URI matching in PathMatcher
A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies PathMatcher does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick th...
CVE-2026-15573 Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher
A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies PathMatcher does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick th...
PT-2026-68175
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description An issue exists in the Authorization Services of Keycloak. The PathMatcher component, which matches request paths to security policies, fails to properly normalize URIs before comparison. An...
fast-uri: fast-uri: URI authority bypass due to improper delimiter handling
A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by crafting a malicious Uniform Resource Identifier URI that contains percent-encoded authority delimiters. The fast-uri library incorrectly decodes these delimiters during normalization and then re-emits them as raw...
fast-uri: fast-uri: URI authority bypass due to improper delimiter handling
A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by crafting a malicious Uniform Resource Identifier URI that contains percent-encoded authority delimiters. The fast-uri library incorrectly decodes these delimiters during normalization and then re-emits them as raw...
Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access Digital Credentials
Summary Security vulnerabilities have been addressed in IBM Verify Identity Access Digital Credentials Vulnerability Details CVEID:CVE-2026-45740 DESCRIPTION: protobufjs compiles protobuf definitions into JavaScript JS functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth...
CVE-2026-6321 fast-uri vulnerable to path traversal via percent-encoded dot segments
fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize and equal functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: raptor2 (UTSA-2026-005274)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005274 advisory. In Raptor RDF Syntax Library through 2.0.16, there is an integer underflow when normalizing a URI with the turtle parser in raptorurinormalizepath. Tenable has...
CVE-2021-22017
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed...
TencentOS Server 3: raptor2 (TSSA-2025:0041)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0041 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...
EUVD-2016-10056
Malware in sbrugna...
EUVD-2020-0333
Malware in sbrugna...