cve-2025-59532-poc

Entorno Docker para CVE-2025-59532 Un entorno de investigación basado en Docker para analizar CVE-2025-59532, una vulnerabilidad de path traversal en OpenAI Codex CLI que permite escribir archivos arbitrarios fuera del sandbox del espacio de trabajo previsto. Parte del curso de CMU: 18-739 Hackin...

CVE-2026-85272

Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extractarchive.py uses isbadpath to validate safeextractall targets by comparing resolved path strings with startswith instead of comparing path component...

CVE-2026-57223

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Surica...

UBUNTU-CVE-2026-57223

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Surica...

cve-2025-24071

CVE-2025-24054 y CVE-2025-24071 - Fuga de hash NTLM mediante exploit .library-ms Este PoC demuestra la explotación de la fuga de hash NTLM mediante archivos .library-ms en sistemas Windows sin parchear Patch Tuesday de marzo de 2025. ⚠️ Esto es solo con fines educativos y de investigación. No lo...

CVE-2021-41773-POC

CVE-2021-41773 漏洞复现报告 漏洞概述 CVE ID : CVE-2021-41773 漏洞名称 : Apache HTTP Server 路径遍历漏洞 风险等级 : 高危 CVSS 7.5 影响版本 : Apache HTTP Server 2.4.49 漏洞描述 : Apache HTTP Server 2.4.49 版本存在路径规范化函数 apnormalizepath 的实现缺陷，攻击者可通过构造含有 %2e 编码的特殊请求绕过访问控制，读取 Web 服务器上的任意文件。 环境搭建 操作系统 : Ubuntu 20.04 虚拟机 Web服务器 : Apache...

struts-uploader-vulnerability

CVE-2024-53677 — Cómo funciona el exploit y cómo ejecutarlo Resumen de la vulnerabilidad El fallo está en cómo FileUploadInterceptor de Struts entrega el nombre del archivo subido a la clase de acción. Normalmente el interceptor sanitiza el nombre del archivo, pero Struts también permite que...

CVE-2026-85272 Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation

Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extractarchive.py uses isbadpath to validate safeextractall targets by comparing resolved path strings with startswith instead of comparing path component...

CVE-2026-85272

CVE-2026-85272 affects Open edX Platform from Aspen.1 through the Ulmo and Verawood.1 releases. The root cause lies in openedx/core/lib/extract_archive.py, where the _is_bad_path function validates extracted archive targets using a string prefix comparison (startswith) instead of comparing indivi...

CVE-2026-85272 Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation

Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extractarchive.py uses isbadpath to validate safeextractall targets by comparing resolved path strings with startswith instead of comparing path component...

EUVD-2026-83399

Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extractarchive.py uses isbadpath to validate safeextractall targets by comparing resolved path strings with startswith instead of comparing path component...

CVE-2026-85272 Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation

Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extractarchive.py uses isbadpath to validate safeextractall targets by comparing resolved path strings with startswith instead of comparing path component...

CVE-2026-57223 Suricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalation

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Surica...

CVE-2025-49132_HTB_SEASON10

CVE-2025-49132 - Exploit RCE de Pterodactyl Panel HTB Temporada 10 - Writeup de la Máquina Pterodactyl Resumen Objetivo: Máquina Pterodactyl HTB Dificultad Media CVE: CVE-2025-49132 Severidad: Crítica CVSS 9.8 Tipo de Ataque: Ejecución Remota de Código No Autenticada Afectado: Pterodactyl Panel...

CVE-2026-82896

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to traverse directories on the system due to a path traversal vulnerability...

CVE-2017-20284

Caucho Resin contains a path traversal vulnerability in the documentation webapp resin-doc that allows remote unauthenticated attackers to read arbitrary files by supplying a relative path through the inputFile request parameter of the jndi-appconfig tutorial servlet. Attackers can craft requests...

EUVD-2026-83440

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory...

CVE-2026-84086 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory...

Improper Encoding or Escaping of Output

Overview uri-js is a RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via pctDecChars, which decodes invalid and overlong percent-encoded sequences in...

CVE-2026-82896 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to traverse directories on the system due to a path traversal vulnerability...