MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files

Summary MariaDB Connector/J checked a server's LOAD DATA LOCAL INFILE file request by searching the text of the command it had sent for LOAD DATA LOCAL INFILE ''. The search also matched inside quoted identifiers, string literals and comments, so text returned by the server and re-used in a later...

GHSA-FHX5-2XQW-2CGM MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files

Summary MariaDB Connector/J checked a server's LOAD DATA LOCAL INFILE file request by searching the text of the command it had sent for LOAD DATA LOCAL INFILE ''. The search also matched inside quoted identifiers, string literals and comments, so text returned by the server and re-used in a later...

SpeculativeExecutionAssessment

SpeculativeExecutionAssessment Assesses a system for the "speculative execution" vulnerabilities described in: CVE-2017-5715 branch target injection CVE-2017-5753 bounds check bypass CVE-2017-5754 rogue data cache load WARNING: Ensure that "Prefer 32-bit" is not checked in the build options...

EUVD-2026-112267

russh: Agent server never calls Agent::confirm, so keys added with the confirm constraint ssh-add -c sign without confirmation...

MAD-CAT

MAD-CAT Meow Attack Data Corruption Automation Tool Overview MAD-CAT Meow Attack Data Corruption Automation Tool is a comprehensive security tool designed to simulate data corruption attacks against multiple database systems. The tool supports both single-target attacks and bulk CSV-based attack...

poc-cve-2018-1273

CVE-2018-1273 Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user or attacker can supply specially crafted...

CVE-2021-38314

CVE-2021-38314 Unauthenticated Sensitive Information Disclosure CVE-2021–38314...

nfstream

NFStreamrepo is a multiplatform Python framework providing fast, flexible, and expressive data structures designed to make working with online or offline network data easy and intuitive. It aims to be Python's fundamental high-level building block for doing practical, real-world network flow data...

details-for-CVE-2022-46505

details-for-CVE-2022-46505 MatrixSSL session resume bug 1. Description of bug An issue in MatrixSSL 4.5.1-open and earlier leads to failure to securely check the SessionID field, resulting in the misuse of an all-zero MasterSecret that can decrypt secret data. 2. Affected version MatrixSSL...

Exploit-CVE-2023-6063-PoC-Vuln

CVE-2023-6063 — WP Fastest Cache SQL Injection PoC -red Proof of Concept PoC for CVE-2023-6063 , an unauthenticated, time-based blind SQL injection vulnerability affecting WP Fastest Cache ≤ 1.2.2. The vulnerability can be triggered through the wordpressloggedin cookie and may allow an attacker t...

SOC235---Atlassian-Confluence-Broken-Access-Control-0-Day-CVE-2023-22515

EVENTID-197 field| Value ---|--- EventID| 197 Event Time| Nov, 09, 2023, 09:47 AM Rule| SOC235 - Atlassian Confluence Broken Access Control 0-Day CVE-2023-22515 Level| Security Analyst Hostname| Confluence Data Center Destination IP Address| 172.16.17.234 Source IP Address| 43.130.1.222 HTTP...

CVE-2026-63396

The open-source review and moderation tool Coop by ROOST is vulnerable to a data leak in versions prior to 1.0.0 . An unauthenticated actor can query the Query.allOrgs field via the /api/v1/graphql endpoint on publicly accessible deployments. This flaw allows the retrieval of sensitive data for a...

CVE-2026-63396 Coop has a data leak via unauthenticated GraphQL Query.allOrgs

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query Query.allOrgs through /api/v1/graphql on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and...

XSS-Catcher

XSS Catcher A blind XSS detection and XSS data capture framework that runs on Flask, VueJS and PostgreSQL. XSS Catcher is an intuitive tool that automates blind Cross-Site Scripting XSS attacks and data gathering, including screenshots. It features a user-friendly payload generator for creating...

cirro-azcli-ext

cirro-azcli-ext An Azure CLI extension that passively collects Azure resource data into a SQLite database compatible with Cirro https://github.com/bishopfox/cirro schema. It also logs all CLI invocations to a JSON-lines file. Hooks into knack events: EVENTINVOKERPOSTPARSEARGS — logs command...

SpyPhone

At BlackHat DC 2010, I presented a paper called iPhone Privacy. In this paper, I call the following Apple claim into question: Applications on the device are "sandboxed" so they cannot access data stored by other applications. In addition, system files, resources, and the kernel are shielded from...

mvt

Mobile Verification Toolkit !IMPORTANT We recently merged the "v3" branch. This introduced breaking changes. If you relied on mvt output in other scripts They might have broken. More details: https://github.com/mvt-project/mvt/issues/757 Mobile Verification Toolkit MVT is a collection of utilitie...

steganographer

Steganography in Python This script will hide files inside images and save the modified image to disk The maximum size of file which can be hidden inside an image depends on the dimension of the image. maxfilesize = heightofimage widthofimage 6 / 8 bytes '100k words.txt' is hidden in...

CVE-2023-49367

CVE-2023-49367 - Sensetive Data Exposure Sensetive Data Exposure in Kyocera Printer Web Panel Vendor: Kyocera Corporation Affected Versions: Command Center RX - EXOSYS M5521cdn Description After connecting to the Kyocera interface address book, test requests for smb and ftp can be seen in the sen...

aleph

.. epigraph:: Truth cannot penetrate a closed mind. If all places in the universe are in the Aleph, then all stars, all lamps, all sources of light are in it, too. -- The Aleph , Jorge Luis Borges ⚠️ PROJECT STATUS: SUNSETTING ⚠️ Our involvement with this open-source project is being sunsetted...