9 matches found
shiro-cve-2020-17523
Apache Shiro 두 가지 방식 인증 우회 분석 CVE-2020-17523 0x01 취약점 설명 Apache Shiro는 강력하고 사용하기 쉬운 Java 보안 프레임워크로, 인증, 권한 부여, 암호 및 세션 관리를 수행합니다. Shiro의 이해하기 쉬운 API를 사용하면 가장 작은 모바일 애플리케이션에서 가장 큰 네트워크 및 엔터프라이즈 애플리케이션에 이르기까지 모든 애플리케이션을 빠르고 쉽게 구현할 수 있습니다. Spring과 함께 사용할 때, 특정 권한 매칭 규칙 하에서 공격자는 특수하게 조작된 HTTP 요청 패킷을...
CVE-2026-66794
A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...
PT-2026-78547
Name of the Vulnerable Software and Affected Versions Multicluster Engine for Kubernetes affected versions not specified Description A flaw in the cluster-proxy-addon component allows an unauthenticated attacker with access to the user-facing route to bypass authentication and authorization check...
CVE-2026-54893
URL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path /users/from/sendMail without percent-encoding or validation. In applications that derive the from address...
CVE-2026-2985
A security flaw has been discovered in Tiandy Video Surveillance System 视频监控平台 7.17.0. This impacts the function downloadImage of the file /com/tiandy/easy7/core/bo/CLSBODownLoad.java. Performing a manipulation of the argument urlPath results in server-side request forgery. The attack is possible...
CVE-2026-2985
A security flaw has been discovered in Tiandy Video Surveillance System 视频监控平台 7.17.0. This impacts the function downloadImage of the file /com/tiandy/easy7/core/bo/CLSBODownLoad.java. Performing a manipulation of the argument urlPath results in server-side request forgery. The attack is possible...
CVE-2025-3454
This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily...
Pyrescom Termod4 time management access control error
A security vulnerability exists in Pyrescom Termod4 time management devices that stems from the inclusion of local files in the devices allowing an authenticated, remote attacker to traverse directories and read sensitive files via the Maintenance Log menu and manipulate file paths in URLs...