CVE-2021-22053

CVE-2021-22053 CVE-2021-22053: уязвимость разрешения шаблонов Spring Cloud Netflix Hystrix Dashboard Описание Приложения, использующие одновременно spring-cloud-netflix-hystrix-dashboard и spring-boot-starter-thymeleaf, предоставляют способ выполнения кода, переданного в пути URI запроса, во врем...

CLEANSTART-2026-BM33422 crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user

Security vulnerability affects the apache2 package. A crafted request uri-path can cause modproxy to forward the request to an origin server choosen by the remote user...

CLEANSTART-2026-WN13169 carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS)

Security vulnerability affects the apache2 package. A carefully crafted request uri-path can cause modproxyuwsgi to read above the allocated memory and crash DoS...

spring-cloud-netflix-hystrix-dashboard-cve-2021-22053

CVE-2021-22053: Spring Cloud Netflix Hystrix Dashboard уязвимость разрешения шаблонов Степень серьезности Высокая Поставщик Spring от VMware Описание Приложения, использующие как spring-cloud-netflix-hystrix-dashboard, так и spring-boot-starter-thymeleaf, предоставляют способ выполнения кода,...

CVE-2021-40438

CVE-2021-40438 Le chemin uri de la requête peut amener modproxy à transférer la requête vers un serveur source choisi par un utilisateur distant. Ce problème affecte Apache HTTP Server 2.4.48 et les versions antérieures. Un attaquant peut exploiter cette vulnérabilité en créant une requête avec u...

CVE-2022-22274_CVE-2023-0656

SonicWall NGFW CVE-2022-22274 и CVE-2023-0656 24 марта 2022 года SonicWall опубликовала уведомление со следующими деталями: Уязвимость переполнения буфера в стеке в SonicOS через HTTP-запрос позволяет удаленному неаутентифицированному злоумышленнику вызвать отказ в обслуживании DoS или потенциаль...

CVE-2021-40438-Apache-2.4.48-SSRF-exploit

CVE-2021-40438 - Apache = 2.4.48 - Exploit SSRF en Python Un chemin d'URI de requête spécialement conçu peut amener modproxy à transférer la requête vers un serveur d'origine choisi par l'utilisateur distant. Ce problème affecte Apache HTTP Server 2.4.48 et versions antérieures. CVSS v3.1: Score ...

PT-2026-103736

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST URI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

EUVD-2026-77584

Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions. The provider maps the caller-controlled URI path directly to a filesystem path and passes it to new File.... It then supports query, openFile,...

Astra Linux – Vulnerability in Apache2

A properly crafted request URI-path can cause modproxy to forward the request to an origin server chosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier...

PT-2026-82512

Name of the Vulnerable Software and Affected Versions ccoap version 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 Description A null pointer dereference occurs in the coap server handle session function when processing COAP messages that include URI PATH options with NULL data pointers. The issue aris...

EUVD-2026-60578

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager...

CVE-2026-17182

CVE-2026-17182 affects IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. It allows a remote attacker to bypass authentication and obtain or alter sensitive information due to improper validation of request URI path segments (CWE-287). The vulnerability has a high impact: CVSS v3.1 base score 9.8 (...

CVE-2026-17182: Improper Authentication

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and obtain or alter sensitive information due to improper validation of request URI path segments...

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3 Summary plabayo/rama contains a stored/reflected cross-site scripting issue in the ServeDir HTML directory listing feature. When ServeDir is configured with DirectoryServeMode::HtmlFileList, file names and U...

CVE-2026-48700

PCManFM-Qt (all versions starting from 1.1.0) is affected by an issue where passing a regular file’s path as a URI in the org.freedesktop.FileManager1.ShowFolders D-Bus call causes PCManFM-Qt to launch another program based on the file type without user confirmation. This could enable code execut...

CVE-2025-55988: Improper Limitation of a Pathname to a Restricted Directory

An issue in the component /Controllers/RestController.php of DreamFactory Core v1.0.3 allows attackers to execute a directory traversal via an unsanitized URI path...

PT-2026-26674

CVE-2025-55988 An issue in the component /Controllers/RestController.php of DreamFactory Core v1.0.3 allows attackers to execute a directory traversal via an unsanitized URI path. https://t.co/bR1dLDXebx...

MiracleLinux 9 : java-11-openjdk-11.0.19.0.7-1.el9 (AXSA:2023-5305:07)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-5305:07 advisory. OpenJDK: improper connection handling during TLS handshake 8294474 CVE-2023-21930 OpenJDK: Swing HTML parsing issue 8296832 CVE-2023-21939 OpenJDK:...

MiracleLinux 8 : java-17-openjdk-17.0.8.0.7-2.el8 (AXSA:2023-6263:12)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-6263:12 advisory. OpenJDK: ZIP file parsing infinite loop 8302483 CVE-2023-22036 OpenJDK: weakness in AES implementation 8308682 CVE-2023-22041 OpenJDK: improper...