آخرین آسیب‌پذیری‌ها

ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List

Traefik 3.2.0 before 3.7.15 FastProxy Data Race Denial of Service

Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret

Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider

Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID

Parse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save Responses

Parse Server 9.0.0 before 9.10.5-alpha.9 Prototype Pollution Denial of Service

CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()

CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header

CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup

CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key

CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI

CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name

CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator

CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig

CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes

Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate

Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty

Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature

Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies

Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection

Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies

Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory

Improper access control vulnerability in ESET Encryption products for Windows