CVE-2024-4956

CVE-2024-4956 - Nexus Repository Manager 3의 인증되지 않은 경로 탐색 Nexus Repository Manager는 개발에 필요한 아티팩트를 구성, 저장 및 배포하는 리포지토리 관리자입니다. Nexus Repository 3에서 3.68.1 이전 버전에 경로 탐색 취약점이 발견되었습니다. 이 취약점을 통해 공격자는 인증 없이 Nexus Repository 애플리케이션의 범위를 벗어난 시스템 파일을 다운로드할 수 있는 URL을 만들 수 있습니다. 이는 중요한 시스템 파일을 노출하고 Nexus...

CVE-2024-4956

CVE-2024-4956 - 인증되지 않은 경로 탐색 취약점 Nexus Repository Manager 3 Nexus Repository Manager는 개발에 필요한 아티팩트를 정리, 저장, 배포하는 저장소 관리자입니다. Nexus Repository 3 버전 3.68.1 미만에서 경로 탐색 취약점이 발견되었습니다. 이 취약점은 공격자가 인증 없이 Nexus Repository 애플리케이션 범위 밖의 시스템 파일을 다운로드할 수 있는 URL을 조작할 수 있게 합니다. 이는 민감한 시스템 파일을 노출시키고 잠재적으로 Nexu...

python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API

A flaw was found in the Python webbrowser.open API. If a specially crafted URL containing "%action" is processed, an attacker could bypass a previous mitigation for CVE-2026-4519. This bypass allows for command injection into the underlying shell, potentially leading to arbitrary code execution...

CVE-2026-31956

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to version 4.4.1, any authenticated user can manually construct a URL to preview campaigns/regions, and export saved reports belonging to other users. Exploitation of th...

python: Python: Command-line option injection in webbrowser.open() via crafted URLs

A flaw was found in Python. The webbrowser.open API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options,...

CVE-2026-25765

A flaw was found in Faraday, an HTTP client library. The buildexclusiveurl method, which combines a base URL with a user-supplied path, incorrectly processes protocol-relative URLs e.g., //evil.com/path. This allows a remote attacker to supply a specially crafted URL, leading to Server-Side Reque...

EUVD-2017-10141

Malware in sbrugna...

EUVD-2018-20682

Malware in sbrugna...

EUVD-2024-2676

Malicious code in bioql PyPI...

EUVD-2022-2491

Malicious code in bioql PyPI...

EUVD-2022-5736

Malicious code in bioql PyPI...

EUVD-2024-2787

Malicious code in bioql PyPI...

CVE-2021-21679

Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...

CVE-2025-30164

The CVE-2025-30164 issue in Icinga Web 2 is an open redirect vulnerability affecting versions before 2.11.5 and 2.12.13, where an authenticated (or easily authenticated) user could be redirected to an arbitrary location via a crafted URL. The root cause is the backend’s redirect logic allowing ar...

CVE-2025-24398

Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 both inclusive allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...

CVE-2025-24398

The Jenkins Bitbucket Server Integration Plugin versions 2.1.0 through 4.1.3 (both inclusive) is vulnerable to a Cross-Site Request Forgery (CSRF) bypass . The root cause is an overly permissive implementation of a Jenkins extension point used to support OAuth 1.0 authentication, which selectivel...

CVE-2024-41732

SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls. Depending on the web applications provided by this server, the attacker might inject CSS code or links into the web application that could allow the attacker to read ...

CVE-2024-33536

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. The vulnerability occurs due to inadequate input validation of the res parameter, allowing an authenticated attacker to inject and execute arbitrary JavaScript code within the context of another user's browser session. By uploading...

BIT-AIRFLOW-2023-40712 Apache Airflow: Secrets can be unmasked in the "Rendered Template"

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI. Users are strongly...

Denial Of Service (DoS)

nuxt-api-party is vulnerable to Denial of Service DoS. The vulnerability could be exploited via crafting a malicious URL and setting high retry attempts, which allows an attacker to trigger a recursive error handling loop, crashing the server and potentially disrupting service for legitimate user...