CVE-2020-37278

Weaver e-Bridge contains an unauthenticated arbitrary file read vulnerability in the saveYZJFile endpoint. Remote attackers can access arbitrary files on the host system, such as /etc/passwd , configuration files, or credentials, by supplying a file: URL to the downloadUrl parameter. Additionally...

CVE-2023-54405 H3C CVM Unauthenticated File Upload via fileUpload/upload Token

H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating the caller-supplied token parameter...

EUVD-2023-60704

H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating the caller-supplied token parameter...

CVE-2023-54405 H3C CVM Unauthenticated File Upload via fileUpload/upload Token

H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating the caller-supplied token parameter...

CVE-2023-54405

The H3C CVM (Cloud Virtualization Management) component of the H3C CAS cloud platform is vulnerable to an unauthenticated arbitrary file upload flaw in the /cas/fileUpload/upload endpoint. The root cause is the lack of restrictions on file types and the failure to sanitize the caller-supplied tok...

SUSE-SU-2026:4436-1 Security update for the Linux Kernel (Live Patch 72 for SUSE Linux Enterprise 12 SP5)

This update for the SUSE Linux Enterprise Kernel 4.12.14-122.272 fixes various security issues: The following security issues were fixed: - CVE-2026-46116: xfrm: defensively unhash xfrmstate lists in xfrmstatedelete bsc1267370. - CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-fr...

Directory Traversal

Overview nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration. Affected versions of this package are vulnerable to Directory Traversal via readNxMigrateConfig in packages/nx/src/utils/package-json.ts, which returned the...

CVE-2025-2945

CVE-2025-2945 - pgAdmin4 認証済みRCEエクスプロイト 作者: G0D150NE バージョン: 2.0.0 CVE: CVE-2025-2945 深刻度: 重大 CVSS 9.9 📌 説明 バージョン 8.10〜9.1 に影響する pgAdmin4 リモートコード実行 RCE の脆弱性に対するエクスプロイトです。 この脆弱性は /sqleditor/querytool/download エンドポイントに存在し、querycommited パラメータがサニタイズされずに Python の eval 関数へ渡されるため、任意のコード実行が可能になります。 ⚡ 機能 ✅...

PEASS-ng v20261002-82d9fad1

PEASS-ng - Privilege Escalation Awesome Scripts SUITE new generation Linux Privesc official course to master LinPEAS Checkhttps://hacktricks-training.com/courses/lhe/ to learn tens of linux privesc techniques and master LinPEAS Basic Tutorial Here you will find privilege escalation tools for...

gha-lab-ca4fa82ac5

自动化研究产物 — 非上游项目。 本仓库是由自动化工具链为拉瓦尔大学（Université Laval）硕士论文构建的一次性实验环境，用于复现已发表的 GitHub Actions 工作流漏洞。它是 mesa/mesa 在提交 821c14475afebc6a68a45bb4b8e87be4d36a0c41（2026-03-04）时的逐字快照，依据该项目自身的许可证重新分发，该许可证文件已原样包含在本快照中。 上游项目未 参与其中，也从未 成为攻击目标，此处研究的漏洞已公开。本仓库中的每个密钥和变量均为随机生成的虚拟值——不存在任何真实凭据。操作引用和运行器镜像均固定为其在...

two-dots-and-a-slash-cve-2026-18907-tecno-hi-browser-download-path-traversal

CVE-2026-18907 — TECNO Hi Browser ダウンロードハンドラにおけるパストラバーサル CVE-2026-18907 （CVSS 7.5 High、CWE-23）の概念実証コードです。TECNO Hi Browser （com.talpa.hibrowser）バージョン 2.23.1.1 のダウンロードファイル機能 に存在する、相対 パストラバーサル脆弱性を実証します。当該ブラウザは攻撃者が制御する Content-Disposition...

CVE-2026-23751-poc

CVE-2026-23751-PoC Proof-of-concept implementation of the .NET HTTP Remoting technique described in Code White's NewRemotingTricks, targeting Tungsten Automation Kofax Capture. CVE-2026-23751 Title: Tungsten Automation Kofax Capture Unauthenticated File Read/Write and Command Execution via .NET...

cve-2023-23397-detection-lab

CVE-2023-23397 Detection & Mitigation Research Lab Overview This project is a defensive cybersecurity research lab focused on the network behavior associated with CVE-2023-23397. The project studies suspicious outbound SMB and NTLM authentication from a Windows endpoint and demonstrates a complet...

fastjson-cve

CVE-2026-16723 再現プロジェクト 概要 このプロジェクトは、fastjson 1.2.68 から 1.2.83 における重大なリモートコード実行（RCE）脆弱性である CVE-2026-16723 を再現します。この脆弱性は、AutoType の有効化や既存のクラスパス上のガジェットを必要とせず、デフォルト設定 のまま RCE を可能にします。 プロパティ| 値 ---|--- CVE ID| CVE-2026-16723 コンポーネント| fastjson 影響を受けるバージョン| 1.2.68 – 1.2.83 修正済みバージョン| 1.2.84+、2.0.0+...

HTB-TwoMillion-machine

Hack The Box - TwoMillion 攻略記事 概要 このリポジトリには、Hack The Box - TwoMillion マシンに対する私のウォークスルーが含まれています。この記事の目的は、私の方法論を記録し、列挙プロセスを説明し、User と Root の両方のアクセスにつながった悪用チェーンを示すことです。 免責事項: この記事は教育目的のみを意図しています。すべての操作は、Hack The Box が提供する法的なラボ環境で実施されました。 マシン情報 プラットフォーム| 難易度| オペレーティングシステム ---|---|--- Hack The Box| 簡単...

CVE-2026-23922

A flaw was found in Zabbix. A highly privileged user, such as a Super Admin, can exploit this vulnerability. By setting a malicious 'Token endpoint' in the email media OAuth configuration, the 'Client secret' can be leaked. This leads to information disclosure of sensitive credentials...

CVE-2026-19264

CVE-2026-19264 - Postiz 中未经验证的路径遍历导致完全接管实例 作者： Krithik Babu P @DarkLycn1976 发布时间： 2026-08-10 CVE： CVE-2026-19264 严重性： 严重 - CVSS 4.0 9.3 / CVSS 3.1 9.8 CWE： CWE-22 - 对受限目录中路径名的限制不当 受影响版本： gitroomhq/postiz-app 2.22.1 修复版本： v2.22.1 TL;DR Postiz 通过一条路由提供本地存储的媒体文件，该路由将 URL...

CVE-2026-94486

A flaw was found in Next.js. The local development server exposes a Model Context Protocol MCP endpoint without properly restricting cross-site requests. If a developer running the development server visits a malicious website, an attacker can issue unauthorized requests to this endpoint, leading...

CVE-2026-94485

A flaw was found in Next.js. During local development, the development server exposes a Model Context Protocol MCP endpoint without properly restricting cross-site requests. If a developer visits a malicious website while running the development server, an attacker can issue unauthorized requests...

Security Bulletin: Due to Logstash, IBM Cloud Pak System is affected by Improper Limitation of a Pathname to a Restricted Directory [CVE-2026-33466]

Summary Vulnerability was found in Logstash shipped with IBM Cloud Pak System. Vulnerability was addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-33466 DESCRIPTION: Improper Limitation of a Pathname to a Restricted Directory CWE-22 in Logstash can lead to...