首页 > 专栏 > PHP Bugs PHP Bugs 共 250 条资讯 [$12000] Mozilla: Unauthenticated RCE in Taskcluster web-server via GraphQL filter argument (sift $where) 2026-06-27 16:20:01 curl: Heap use-after-free (write) in mev_forget_socket() via reentrant curl_easy_pause() — incomplete fix for CVE-2026-9080 2026-06-27 16:20:01 Monero: `relay_tx` wallet-rpc skips `--restricted-rpc` guard and lets any caller corrupt wallet state via attacker-controlled `pending_tx` 2026-06-27 16:20:01 Monero: wallet-rpc describe_transfer uses real_output_in_tx_index instead of real_output: cold-wallet pre-sign review shows wrong ring member 2026-06-27 16:20:01 Monero: SpendProofV1 txid-substitution: get_spend_proof/check_spend_proof do not verify returned transaction hash 2026-06-27 16:20:01 Monero: wallet-rpc crash via malformed /gettransactions response (empty txs → vector::front() in check_tx_key / check_tx_proof) 2026-06-27 16:20:01 Monero: `check_reserve_proof` sums RingCT ECDH amounts without checking the output commitment 2026-06-27 16:20:01 Monero: `check_reserve_proof` counts duplicate entries: one output can inflate `total` 2026-06-27 16:20:01 curl: curl Missing Sec-WebSocket-Accept Verification Enables MITM WebSocket Session Hijacking 2026-06-27 16:20:01 curl: SMTP CRLF injection in custom SMTP recipient operand allows additional SMTP commands after authentication 2026-06-27 16:20:01 Rocket.Chat: Unauthenticated Path Traversal (LFI) via /custom-sounds/ when CustomSounds uses FileSystem storage 2026-06-27 16:20:01 AWS VDP: GitHub Retired UsernameTakeover From [aws/████████] 2026-06-27 16:20:01 Tucows (VDP): Stored XSS in nameserver field on account settings page 2026-06-27 16:20:01 Node.js: HTTP Request Smuggling via Connection: close<TAB> in Node.js llhttp parser 2026-06-27 16:20:01 [$100] Liberapay: Unauthenticated team "income/payments" export ignores donor privacy settings (hide_giving, hide_from_lists) and uses frozen visibility, exposing donat 2026-06-27 16:20:01 Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934) 2026-06-27 16:20:01 Ruby on Rails: Active Storage Vips Transformer Missing validate_transformation — CVE-2025-24293 Incomplete Fix 2026-06-27 16:20:01 Node.js: Permission Model bypass: process.report writes (and overwrites) files outside --allow-fs-write paths 2026-06-27 16:20:01 phpBB: Stored XSS via SVG Upload — check_content() Blocklist Bypass & 256-Byte Scan Limit (Self-Propagating Worm) 2026-06-27 16:20:01 Rocket.Chat: Unauthenticated SSRF in Voxtelesys integration ('checkUrlForSsrf' Bypass via DNS rebinding) 2026-06-27 16:20:01 « 上一页1…7891011…13下一页 » 相关分类 P #!/slash/note #UNTAG (B)(F)uzzing on my world (Hi)story (IN)SECURE Magazine Notification (gdb) break *0x972 - 带鱼博客 BeltfishBlog - ./kwaa.dev .NET Blog .Trash /home/rook1e 00's Adventure 0kami's Blog 0x41414141 in ?? () 0x7f Blog 0xRick Owned Root ! 0xd00's blog 1 Byte 1A23 Blog 1A23 Studio 1Link.Fun 1stwebdesigner 251 2BAB 的工程博客 2ch中文网 360 CERT 360 Netlab Blog - Network Securi 38号车评中心 3o米的微博