CVE-2026-82111

iswalle getnote-mcp (up to version 1.5.0 ) is affected by a path traversal vulnerability in the upload_image component. The affected element is the fs.readFileSync function in src/index.ts, where manipulation of the image_path argument allows an attacker to read files outside the intended directo...

CVE-2023-30146

CVE-2023-30146 - Exploit per Webcam Assmann/HooToo - Esposizione di Dati Sensibili Descrizione È stato scoperto un problema nelle IP camera dei marchi HooToo e Assmann. Il firmware memorizza le credenziali di amministratore e utente nel backup in chiaro. Il backup può essere recuperato e...

attackmapper

AttackMapper Piattaforma di visualizzazione delle traiettorie d'attacco e threat intelligence Caratteristiche • Installazione • Utilizzo • Intelligence sulle minacce • Contribuisci Panoramica AttackMapper è uno strumento CLI per operazioni red team che genera percorsi d'attacco, mappa le tecniche...

WhisperPair

WhisperPair: Banco di prova per Google Fast Pair -green Uno strumento pratico per testare se i dispositivi Google Fast Pair sono vulnerabili ad attacchi di associazione, binding dell'account e attacchi a livello di protocollo. Questo repository fornisce il banco di prova WhisperPair, uno strument...

CVE-2014-6271-EXPLOIT

CVE-2014-6271 - Shellshock 💣 Shellshock ist eine kritische Schwachstelle in der GNU-Bash-Shell. Sie betrifft Versionen bis einschließlich 4.3 und ermöglicht es entfernten Angreifern, beliebigen Code auszuführen. Diese Schwachstelle entsteht durch die Art und Weise, wie Bash nachgestellte...

EUVD-2026-67681

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

CVE-2026-73209

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

CVE-2026-52681

Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active script. Compiled script files are also not removed when a script is deleted or renamed. The configured Sieve CPU limit can be bypassed,...

CVE-2026-42393

CVE-2026-42393 affects the doveadm service in Open-Xchange's Dovecot implementation. The password and API key comparison is not fully timing-safe, allowing a network-adjacent attacker who can make repeated requests and accurately measure response times to learn the length of the configured secret...

EUVD-2026-67676

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

CVE-2026-42391

An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by...

EUVD-2026-67669

When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail and other mail in the same mailbox. An attacker that can send mail to a user and can also observe the sizes of that user's IMAP traffic can...

CVE-2026-40019

An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can cause degradation or denial of service for Sieve script management, and repeated connections can consume all available CPU on the...

CVE-2026-40015

An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermittently cause an out-of-bounds read and crash the process. The crash interrupts hibernated IMAP sessions handled by the affected process, which can cause...

CVE-2026-40014

An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor...

CVE-2026-40013

An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script. This causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of...

EUVD-2026-67662

An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. No publicly available exploits are...

CVE-2022-0185-Analysis-and-Exploit

CVE-2022-0185-Analysis-and-Exploit Pesquisa e prova de conceito para a vulnerabilidade de estouro de heap do kernel Linux CVE-2022-0185. CVE-2022-0185 – Análise de Estouro de Heap do Kernel Linux Visão Geral CVE-2022-0185 é uma vulnerabilidade de estouro de buffer baseado em heap na implementação...

CVE-2020-13159

CVE-2020-13159 - Artica Proxy precedente alla 4.30.000000 Community Edition consente molteplici iniezioni di comandi del sistema operativo. Descrizione del prodotto: Artica Tech offre una soluzione potente ma semplice da usare, di solito prerogativa delle grandi aziende e delle multinazionali. Co...

CVE-2020-10129

CVE-2020-10129 - Il prodotto SearchBlox precedente alla V-9.2 è vulnerabile all'escalation dei privilegi: un utente di livello inferiore è in grado di accedere all'Admin Descrizione del prodotto: SearchBlox semplifica la ricerca aziendale per le organizzazioni complesse. Gli strumenti intuitivi e...