Monthly
Cross-Origin Resource Sharing (CORS) bypass in Jupyter Server <= 2.17.0 allows attackers controlling malicious subdomains to bypass origin validation and access sensitive notebook data. The vulnerability stems from incorrect use of Python's re.match() function in the allow_origin_pat configuration, which only anchors at the start of strings. An attacker registering a domain like 'trusted.example.com.evil.com' can pass validation intended only for 'trusted.example.com', enabling unauthorized cross-origin requests to Jupyter sessions. Fixed in version 2.18.0 via commits 057869a and 49b3439. No active exploitation or public POC identified at time of analysis.
WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages. WebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor. An application that accepts uploads by checking only the final extension lets a remote attacker upload a file such as report.psp.pdf and run its embedded Perl by requesting it.
Unauthenticated remote attackers can bypass route-based access control rules in tinyauth deployments running versions before 5.1.3 by appending a string that matches an allowed route to a restricted path, because the underlying authorization regex is not anchored. The flaw is remotely reachable wherever tinyauth fronts an application and requires no credentials or user interaction, though exploitation depends on the attacker knowing or inferring the allowed route patterns (CVSS 3.1 base 5.4, AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N). No public exploit identified at time of analysis, and the vendor has released a fix in 5.1.3 per advisory GHSA-r27r-rr9v-vv37.
Unanchored regular expression matching in Apache Traffic Server exposes a high-severity bypass that allows remote unauthenticated attackers to circumvent regex-based access controls, potentially leaking protected content (C:H) and enabling limited unauthorized writes (I:L). All 9.0.x through 9.2.14 and 10.0.x through 10.1.3 deployments that rely on regex-driven rules for routing, ACL, or header policy enforcement are at risk. No public exploit code has been identified at time of analysis, and CISA has not listed this in KEV, but the low-complexity, unauthenticated network attack path makes it a realistic opportunistic target for any actor aware of the flaw.
Cross-Origin Resource Sharing (CORS) bypass in Jupyter Server <= 2.17.0 allows attackers controlling malicious subdomains to bypass origin validation and access sensitive notebook data. The vulnerability stems from incorrect use of Python's re.match() function in the allow_origin_pat configuration, which only anchors at the start of strings. An attacker registering a domain like 'trusted.example.com.evil.com' can pass validation intended only for 'trusted.example.com', enabling unauthorized cross-origin requests to Jupyter sessions. Fixed in version 2.18.0 via commits 057869a and 49b3439. No active exploitation or public POC identified at time of analysis.
WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages. WebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor. An application that accepts uploads by checking only the final extension lets a remote attacker upload a file such as report.psp.pdf and run its embedded Perl by requesting it.
Unauthenticated remote attackers can bypass route-based access control rules in tinyauth deployments running versions before 5.1.3 by appending a string that matches an allowed route to a restricted path, because the underlying authorization regex is not anchored. The flaw is remotely reachable wherever tinyauth fronts an application and requires no credentials or user interaction, though exploitation depends on the attacker knowing or inferring the allowed route patterns (CVSS 3.1 base 5.4, AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N). No public exploit identified at time of analysis, and the vendor has released a fix in 5.1.3 per advisory GHSA-r27r-rr9v-vv37.
Unanchored regular expression matching in Apache Traffic Server exposes a high-severity bypass that allows remote unauthenticated attackers to circumvent regex-based access controls, potentially leaking protected content (C:H) and enabling limited unauthorized writes (I:L). All 9.0.x through 9.2.14 and 10.0.x through 10.1.3 deployments that rely on regex-driven rules for routing, ACL, or header policy enforcement are at risk. No public exploit code has been identified at time of analysis, and CISA has not listed this in KEV, but the low-complexity, unauthenticated network attack path makes it a realistic opportunistic target for any actor aware of the flaw.