204702 matches found
CVE-2026-86259
CVE-2026-86259 - OpenMAIC 1.0.0: SSRF saliente no autenticada al servicio de metadatos en la nube mediante middleware fail-open y omisión de validación condicionada por el entorno Descripción general Verificado. Existe una cadena de explotación de dos tramos en el middleware de autenticación de...
vulnerability-remediation-cve-2013-3900
🛡️ CVE-2013-3900: WinVerifyTrust हस्ताक्षर सत्यापन का उपचार 📝 परियोजना अवलोकन यह परियोजना एक वास्तविक दुनिया के भेद्यता प्रबंधन कार्यप्रवाह को प्रदर्शित करती है। एक Azure VM का उपयोग करके, मैंने एक उच्च-गंभीरता वाले हस्ताक्षर सत्यापन दोष का पता लगाया, PowerShell के माध्यम से मैन्युअल रूप से इसकी...
CVE-2025-63571
描述 在对 AI 系统（ChatGPT GPT-5）进行分析时，发现了一个服务端请求伪造（SSRF）漏洞。 该问题的产生是因为应用程序在未进行任何验证或清理的情况下，自动获取并执行用户提交的外部 URL（例如 webhook）。 通过利用此缺陷，攻击者可以强制 AI 服务器向内部或外部系统发起任意 HTTP 请求。这种行为会暴露敏感信息，例如服务器的真实 IP 地址、HTTP 标头、内部服务，以及潜在的云元数据。 受影响端点 https://chatgpt.com/ 受影响参数 任何用户可提交 URL 供 AI 处理的输入字段或消息。 Payload 示例...
CVE-2026-106494
A flaw was found in the @backstage/backend-defaults package of Backstage. Improper input validation in cloud storage URL readers allows an attacker with write access to an associated cloud storage bucket to create specially crafted object names. Under certain deployment configurations, these name...
CVE-2026-106498
A flaw was found in @backstage/plugin-catalog-backend. An authenticated remote user can craft a catalog entity containing placeholder directives that reference resources outside the entity's source repository due to improper URL validation. Under certain configurations, this can lead to informati...
python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()
A flaw was found in Python. When establishing secure connections using the SSLContext.wrapbio function with hostname checking enabled, the module fails to validate that a target server hostname is supplied. Because of this missing check, certificate hostname verification is silently skipped rathe...
EUVD-2026-94124
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command 'Code Injection' related to improper input validation...
EUVD-2026-94123
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation...
CVE-2026-20127-Exploit-Extension
Executive Summary The CVE-2026-20127 Defensive Companion is a premier, enterprise-grade Browser Extension engineered for proactive threat intelligence and defensive analysis. This tool encapsulates authoritative technical research concerning the authentication bypass vulnerability in the Cisco...
CVE-2026-106299
An improper input validation flaw was found in the WebAudio component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/519211890...
moveit-transfer-2023-breach
MOVEit Transfer 2023 大规模数据泄露事件 事件详情 事件日期：2023年5月至6月 CVE：CVE-2023-34362 攻击类型：SQL注入 威胁行为者：Cl0p勒索软件组织 摘要 2023年5月，MOVEit Transfer中的一个SQL注入漏洞被利用，导致数百家组织的敏感数据被窃取。 课程相关性 本项目涉及Web安全、输入验证、SQL注入以及最小权限访问。 作者 姓名：YOUR NAME edX用户名：YOUREDXUSERNAME GitHub用户名：YOURGITHUBUSERNAME...
CVE-2026-102478
In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...
CyberPanel - Command Injection
CyberPanel contains a command injection vulnerability in the /ftp/getresetstatus and /dns/getresetstatus endpoints.The vulnerability exists due to improper validation of the 'statusfile' parameter, which is directly used in a shell command.The security middleware only validates POST requests,...
Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)
Microsoft Exchange Server contains a remote code execution caused by improper input validation in the server component, letting remote attackers execute arbitrary code, exploit requires network access to the server. id: CVE-2021-28480 info: name: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass...
CVE-2026-106414
An improper input validation flaw was found in the Mobile component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/504223609...
CVE-2026-102478
In affected versions of Octopus Server , an authenticated user with permissions to modify roles can achieve privilege escalation . The vulnerability is caused by the improper validation of unsafe equivalence in inputs , allowing an attacker to weaken built-in roles and add their account to a priv...
EUVD-2026-94154
In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...
CVE-2026-102478
In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...
CVE-2026-102478
In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...