SEC Consult SA-20261104-0 :: Improper device certificate validation enables AiTM attacks in Siemens SICAM Toolbox II device communication Full Disclosuremailing list archivesFrom: SEC Consult Vulnerability Lab via Full... 2026-11-5 04:30:30 | 阅读: 27 | 收藏 | Full Disclosure - seclists.org siemens toolbox sicam security software

Apache Struts2 Tiles Plugin <=7.4.0 and >=6.3.0 Preparer Cache Vulnerabilities Full Disclosuremailing list archivesFrom: Daniel Owens via Fulldisclosure <fulld... 2026-11-5 04:29:58 | 阅读: 29 | 收藏 | Full Disclosure - seclists.org tiles preparers preparer

unixODBC <=2.3.14 Rude Truncation via Narrowing Conversion Causes Out-of-Bounds `memcpy` Full Disclosuremailing list archivesFrom: Daniel Owens via Fulldisclosure <fulld... 2026-11-5 04:29:57 | 阅读: 24 | 收藏 | Full Disclosure - seclists.org sqllen bcol sqlbindcol rowset cbuf

unixODBC <=2.3.14 Multiple Races Full Disclosuremailing list archivesFrom: Daniel Owens via Fulldisclosure <fulld... 2026-11-5 04:29:55 | 阅读: 17 | 收藏 | Full Disclosure - seclists.org pooling pthread

unixODBC <=2.3.14 Multiple Heap Buffer Overflows, Underflows, and Over-Reads Full Disclosuremailing list archivesFrom: Daniel Owens via Fulldisclosure <fulld... 2026-11-5 04:29:54 | 阅读: 21 | 收藏 | Full Disclosure - seclists.org hdbc overflow sqlchar henv

Apache Struts2 Core Arbitrary Code Execution via OGNL Sandbox Escape Full Disclosuremailing list archivesFrom: Daniel Owens via Fulldisclosure <fulld... 2026-11-2 06:10:55 | 阅读: 31 | 收藏 | Full Disclosure - seclists.org beans attackers protections cursory

Apache Struts2 Core TokenHelper Token Cryptographic Timing Side-Channel Full Disclosuremailing list archivesFrom: Daniel Owens via Fulldisclosure <fulld... 2026-11-2 06:10:54 | 阅读: 27 | 收藏 | Full Disclosure - seclists.org tokenname tokenhelper invocation dispatcher

Apache Struts2 Spring Plugin Uses a Previously Closed Resource Full Disclosuremailing list archivesFrom: Daniel Owens via Fulldisclosure <fulld... 2026-11-2 06:10:52 | 阅读: 27 | 收藏 | Full Disclosure - seclists.org struts reloading appcontext

Apache Struts2 Core Integer Overflow Full Disclosuremailing list archivesFrom: Daniel Owens via Fulldisclosure <fulld... 2026-11-2 06:10:51 | 阅读: 24 | 收藏 | Full Disclosure - seclists.org urlencode showcase grouped overflow totype

Apache Struts2 Core Cross-Origin Protection Exemption Miskeyed to a Deployment-Wide Path Full Disclosuremailing list archivesFrom: Daniel Owens via Fulldisclosure <fulld... 2026-11-2 06:10:50 | 阅读: 22 | 收藏 | Full Disclosure - seclists.org invocation

Apache Struts2 REST Plugin Fails to Properly Parse Chunked Requests Full Disclosuremailing list archivesFrom: Daniel Owens via Fulldisclosure <fulld... 2026-11-2 06:10:48 | 阅读: 23 | 收藏 | Full Disclosure - seclists.org chunked orders showcase clientname

Apache Struts2 REST Plugin Untrimmed `Accept` Header Tokens Break Content Negation Fallback Full Disclosuremailing list archivesFrom: Daniel Owens via Fulldisclosure <fulld... 2026-11-2 06:10:47 | 阅读: 22 | 收藏 | Full Disclosure - seclists.org findhandler fallback

Apache Struts2 JSON Plugin Insecure Deserialisation -- Object Deserialisation Element-Count Limit Bypass Full Disclosuremailing list archivesFrom: Daniel Owens via Fulldisclosure <fulld... 2026-11-2 06:10:46 | 阅读: 17 | 收藏 | Full Disclosure - seclists.org maxelements 2026 attackers

[0day-rubbish] NETGEAR RAX120 V1.2.5.18 authenticated SOAP InstallApp OS command injection to root-configured web-stack execution (6.8 Medium; conditionally 7.2 High with management exposure) Full Disclosuremailing list archivesFrom: disclosure via Fulldisclosure <fulldis... 2026-10-29 04:12:45 | 阅读: 28 | 收藏 | Full Disclosure - seclists.org validator injection firmware quote rubbish

[0day-rubbish] Raritan PX3 PDU G4 firmware 4.3.14 command injection in the ping and traceroute diagnostics through an inverted hostname-validation return check (8.8) Full Disclosuremailing list archivesFrom: disclosure via Fulldisclosure <fulldis... 2026-10-29 04:12:44 | 阅读: 39 | 收藏 | Full Disclosure - seclists.org traceroute diagnostics rubbish injection rejection

[0day-rubbish] NUUO Crystal Server 3.19.0.85 unauthenticated upload.php PHP web-root write with fastcgi execution into server-side code execution as the web service account (9.8 Critical) Full Disclosuremailing list archivesFrom: disclosure via Fulldisclosure <fulldis... 2026-10-29 04:12:43 | 阅读: 26 | 收藏 | Full Disclosure - seclists.org php appliance served recovered

[0day-rubbish] Moxa MAR-2000 firmware FWR_MAR2000_V1.0_Build_15010909 scenario ping condition command injection through the auto-executing ping thread (7.2) Full Disclosuremailing list archivesFrom: disclosure via Fulldisclosure <fulldis... 2026-10-29 04:12:41 | 阅读: 31 | 收藏 | Full Disclosure - seclists.org rubbish injection marker watchdog monitoring

[0day-rubbish] Moxa MAR-2000 firmware FWR_MAR2000_V1.0_Build_15010909 IPsec tunnel address command injection through the route-management shell commands (7.2) Full Disclosuremailing list archivesFrom: disclosure via Fulldisclosure <fulldis... 2026-10-29 04:12:40 | 阅读: 26 | 收藏 | Full Disclosure - seclists.org tunnel ipsec rubbish injection payload

[0day-rubbish] Moxa MAR-2000 firmware FWR_MAR2000_V1.0_Build_15010909 command injection in the Executer program activation path (7.2) Full Disclosuremailing list archivesFrom: disclosure via Fulldisclosure <fulldis... 2026-10-29 04:12:39 | 阅读: 25 | 收藏 | Full Disclosure - seclists.org executer injection rubbish benign activation

Re: CVE-2026-109618: PHP-CGI Pointer Underflow → Remote Code Execution (CVSS 9.2) Full Disclosuremailing list archivesFrom: fulldisclosure <fulldisclosure () evol... 2026-10-29 04:12:2 | 阅读: 39 | 收藏 | Full Disclosure - seclists.org 2026 php remote underflow