https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 06:12:35 +0000 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0878 certfr-2024-avi-0878 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0878 https://cve.radiocsirt.org/vuln/euvd-2026-209211 EUVD-2026-209211 https://cve.radiocsirt.org/vuln/euvd-2026-209211 https://cve.radiocsirt.org/vuln/fkie_cve-2023-29401 <p>The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of &#34;setup.bat&amp;quot;;x=.txt&#34; will be sent as a file named &#34;setup.bat&#34;. If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.</p> <p>The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of &#34;setup.bat&amp;quot;;x=.txt&#34; will be sent as a file named &#34;setup.bat&#34;. If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-29401 https://cve.radiocsirt.org/vuln/ghsa-2c4m-59x9-fr2g <p><strong>Affected:</strong> Go: github.com/gin-gonic/gin</p> <p>The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of &#34;setup.bat&amp;quot;;x=.txt&#34; will be sent as a file named &#34;setup.bat&#34;.</p> <p>If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.</p> <p><strong>Affected:</strong> Go: github.com/gin-gonic/gin</p> <p>The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of &#34;setup.bat&amp;quot;;x=.txt&#34; will be sent as a file named &#34;setup.bat&#34;.</p> <p>If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.</p> https://cve.radiocsirt.org/vuln/ghsa-2c4m-59x9-fr2g https://cve.radiocsirt.org/vuln/gsd-2023-29401 gsd-2023-29401 https://cve.radiocsirt.org/vuln/gsd-2023-29401 https://cve.radiocsirt.org/vuln/rhba-2023:6078 <p>golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding golang-github-gin-gonic-gin: Improper Input Validation graphql: Insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries golang-github-gin-gonic-gin: Gin Web Framework does not properly sanitize filename parameter of Context.FileAttachment function golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)</p> <p>golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding golang-github-gin-gonic-gin: Improper Input Validation graphql: Insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries golang-github-gin-gonic-gin: Gin Web Framework does not properly sanitize filename parameter of Context.FileAttachment function golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)</p> https://cve.radiocsirt.org/vuln/rhba-2023:6078 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-29401 <p><strong>Affected:</strong> Ubuntu:18.04:LTS: golang-github-gin-gonic-gin, Ubuntu:20.04:LTS: golang-github-gin-gonic-gin, Ubuntu:22.04:LTS: golang-github-gin-gonic-gin, Ubuntu:24.04:LTS: golang-github-gin-gonic-gin, Ubuntu:25.10: golang-github-gin-gonic-gin, Ubuntu:26.04:LTS: golang-github-gin-gonic-gin</p> <p>The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of &#34;setup.bat&amp;quot;;x=.txt&#34; will be sent as a file named &#34;setup.bat&#34;. If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.</p> <p><strong>Affected:</strong> Ubuntu:18.04:LTS: golang-github-gin-gonic-gin, Ubuntu:20.04:LTS: golang-github-gin-gonic-gin, Ubuntu:22.04:LTS: golang-github-gin-gonic-gin, Ubuntu:24.04:LTS: golang-github-gin-gonic-gin, Ubuntu:25.10: golang-github-gin-gonic-gin, Ubuntu:26.04:LTS: golang-github-gin-gonic-gin</p> <p>The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of &#34;setup.bat&amp;quot;;x=.txt&#34; will be sent as a file named &#34;setup.bat&#34;. If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-29401 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3370 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat OpenShift ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat OpenShift ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3370