/dev/posts/

Vulnerabilities

Here are some of the vulnerabilities I found. A few were independently discovered by someone else.

IdentifierVulnerability
N/ATool call execution through user prompt injection (CSRF) of the llama-server Web UI
N/AUser prompt CSRF on Mistral Le Chat
N/AUser prompt CSRF on Grok
CVE-2026-62995 GHSA-5jhw-7jv7-qcqqjoserfc accepts JWT with padding, leading to JWT malleability
CVE-2026-50571, GHSA-f4hw-w632-m6whRisk of reflected cross site scripting and Content-Security-Policy bypass in the WebSub intent verification
N/AHost-ambiguous requests through $http_host in NGINX
N/AHost-ambiguous requests through Debian's NGINX proxy_params
N/APass-the-permission-ticket vulnerability in UMA 2.0
N/AArbitrary code execution through kitty-open.desktop file association
CVE-2023-28371Arbitrary file write (through directory traversal) in Stellarium
CVE-2023-27986Emacs Lisp injection in Emacs
CVE-2023-27985Shell command injection in Emacs
CVE-2023-26314Arbitrary code execution through dangerous file association in Debian Mono package
N/ADNS rebinding vulnerability on Hetty's API
CVE-2022-27820Lack of X.509 TLS certificate validation in OWASP ZAP
CVE-2022-26505DNS rebinding in ReadyMedia/MiniDLNA
CVE-2022-28108CSRF on Selenium standalone server
CVE-2022-28109DNS rebinding on Selenium standalone server
CVE-2021-33516DNS rebinding in GUPnP
CVE-2021-32563Local program invocation without confirmation through Thunar command-line argument
N/ALocal program invocation without confirmation through PCManFM command-line argument
N/ALocal program invocation without confirmation through PCManFM-Qt command-line argument
N/AFile type description spoofing in Firefox and Thunderbird
N/AFirefox and Thunderbird accept special Freedesktop MIME types
CVE-2021-31718DNS rebinding in npupnp
CVE-2021-29462DNS rebinding in pupnp
CVE-2021-4138DNS rebinding in GeckoDriver
N/ADNS rebinding and CSRF on Samsung TV DIAL implementation
N/ADNS rebinding vulnerability in Samsung SmartTV UPnP
CVE-2020-26961DoH RFC1918 addresses protection bypass using IPv4-mapped address in Firefox
CVE-2020-24373CSRF in Freebox Server UPnP MediaServer
CVE-2020-24374DNS rebinding in Freebox v5 modem Web UI
CVE-2020-24375DNS rebinding in Freebox Server UPnP MediaServer
CVE-2020-24376DNS rebinding in Freebox UPnP IGD
CVE-2020-24377DNS rebinding in Freebox Server Web UI
CVE-2020-15660CSRF to RCE in geckodriver
CVE-2020-15271Code injection in lookatme
CVE-2019-7653Code injection in python-rdflib-tools Debian package
N/ACSRF in several YunoHost/BriqueInternet applications
CVE-2018-10992Shell command injection in lilypond
CVE-2017-17523Shell command injection in lilypond
CVE-2017-18266Argument injection in xdg-open
CVE-2017-17512Argument injection in sensible-browser