Vulnerabilities tagged "filter-bypass"

[Kubernetes] Ingress nginx annotation injection causes arbitrary command execution

This vulnerability impacts kubernetes setups using NGINX as the ingress controller via [ingress-nginx]( At first I wanted to blame this one on block-listing when they should have used an allow-list, but its not quite that, but it is basically just a missed edge-case that allows for code execution.

Our Pwn2Own journey against time and randomness (part 2)

Just a somewhat common and vulnerable use a cryptography.The `signature` of a firmware was not truly a signature but a hash of the content + a secret key, as the binary code that verifies the firmware is present on the device the "secret" key used is not kept secret and one could create their own firmware that would pass the signature check but contain arbitrary content...

XNU: NFSSVC root check bypass; use after free due to insufficient locking in upcall worker threads

This was a fun authorization check bypass because when checking if higher privileges were needed the `flag` value was checked for equality with the two privileged actions.Later on however, when deciding what handler to use to handle to request, it used a bitwise operation to check if the specific bit is set...

SSRF Cross Protocol Redirect Bypass

When using the `ssrfFilter` library in conjunction with the Request library in JavaScript there is a bug that can result in the SSRF filter being disabled.The way the anti-SSRF library, `ssrfFilter` works is that is creates its own object that cna be used in=place of Node's default request agent for http/http requests...