activemq-ids-ips-lab

IDS/IPS प्रयोगशाला - Apache ActiveMQ को RCE हमलों से बचाना यह परियोजना मूल्यांकन करती है कि कैसे IDS और IPS तंत्र एक नियंत्रित प्रयोगशाला वातावरण में Apache ActiveMQ की कमजोरी CVE-2023-46604 के शोषण का पता लगा सकते हैं और उसे रोक सकते हैं। परियोजना अवलोकन प्रयोगशाला को एक यथार्थवादी हमला-और-बचाव...

CVE-2024-2887-REPORT

SSD Advisory – Google Chrome RCE المصدر: ssd-disclosure.com/ssd-advisory-google-chrome-rce الملخص ثغرة حرجة في تنفيذ التعليمات البرمجية عن بُعد في متصفح Google Chrome الإصدارات 123 وما قبلها تؤثر على معالجة أنواع جمع القمامة garbage-collection في WebAssembly WASM. يتسبب الخطأ في ارتباك الأنواع ty...

Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

Impact This is a prototype pollution / improper client lookup vulnerability in @socket.io/cluster-engine. Servers using @socket.io/cluster-engine may be impacted when attacker-controlled session IDs are processed in clustered deployments. A malicious client could use special property names such a...

CVE-2026-105684 Penpot: Share-link page-scope escape — comment RPCs leak comment content, author identity, and all page-ids for pages outside the share scope

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissions! but do not apply the share link's pages restriction. A holder of a page-scoped share link can retrieve comment threa...

CVE-2026-105684 Penpot: Share-link page-scope escape — comment RPCs leak comment content, author identity, and all page-ids for pages outside the share scope

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissions! but do not apply the share link's pages restriction. A holder of a page-scoped share link can retrieve comment threa...

Astra Linux – Vulnerability in Thunderbird

Thunderbird did not check whether the user ID associated with an OpenPGP key has a valid self-signature. An attacker may create a forged version of an OpenPGP key, either by replacing the original user ID or by adding another user ID. If Thunderbird imports and accepts the forged key, the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ICE: xsk: prohibit usage of non-balanced queue ID Fix the following scenario: 1. ethtool -L $IFACE rx 8 tx 96 2. xdpsock -q 10 -t -z The above refers to a situation where a user wants to attach an XSK socket in txonly mode at a...

CVE-2026-104967: Authorization Bypass Through User-Controlled Key

Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/ accept body- or URL-supplied issue IDs and operate on them without checking that the IDs belong to the caller's workspace and project. The permission...

Deep Defence on Wheels: A Dual Intrusion Detection System Architecture for Comprehensive In-Vehicle Network Security

Increasing connectivity to the outside world and the lack of inbuilt security mechanisms have made legacy intra-vehicular networks vulnerable to cyberattacks. Initial research focused on maximising detection accuracy for known and unknown attacks, often using large, full-precision machine learnin...

log4shell-coraza

Laboratoire de Sécurité Log4Shell — nginx + Coraza WAF Objectif éducatif / défensif : ce laboratoire contient une application intentionnellement vulnérable Log4j 2.14.1 et une boîte à outils d'exploitation JNDI, UNIQUEMENT destinée à apprendre à détecter et bloquer Log4Shell dans un environnement...

CVE-2026-105205

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected and publish-disabled documents by querying a published document. Attackers can send POST requests to /api/block/getDocInfo...

CVE-2026-105205 SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected and publish-disabled documents by querying a published document. Attackers can send POST requests to /api/block/getDocInfo...

CVE-2026-105205

The SiYuan note-taking application (versions prior to 3.8.5 ) is vulnerable to an information disclosure vulnerability. An attacker can bypass the publish confidentiality boundary by sending POST requests to the /api/block/getDocInfo or getDocsInfo endpoints for a published document. This allows ...

CVE-2026-105205 SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected and publish-disabled documents by querying a published document. Attackers can send POST requests to /api/block/getDocInfo...

qub-network-security-cve-2023-20198

🛡️ qub-network-security-cve-2023-20198 تحليل واكتشاف وتخفيف استغلال CVE-2023-20198 في Cisco IOS XE 📘 جامعة كوينز بلفاست – تقييم أمن الشبكات CSC3064 📋 نظرة عامة على التقييم يتضمن هذا المشروع تحليل ملفات PCAP المقدمة من Fox-IT إلى: تحديد مؤشرات الاختراق IOCs عرض الاستغلال باستخدام حزم مخصصة الصنع...

CVE-2026-105205: Exposure of Sensitive Information to an Unauthorized Actor

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected and publish-disabled documents by querying a published document. Attackers can send POST requests to /api/block/getDocInfo...

-CVE-2024-6095

Key Enhancements: 1. Random String Obfuscation : Introduced random string generation to obfuscate paths, making detection harder. 2. Advanced Payloads : Added more sophisticated payloads with different obfuscation techniques to evade security mechanisms. 3. Custom Headers : Included custom header...

CVE-2026-103762

SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read-only publish visitors to learn unpublished notebook box IDs. Attackers with read-only or anonymous publish access can POST any...

CVE-2026-103762 SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints

SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read-only publish visitors to learn unpublished notebook box IDs. Attackers with read-only or anonymous publish access can POST any...

EUVD-2026-91419

SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read-only publish visitors to learn unpublished notebook box IDs. Attackers with read-only or anonymous publish access can POST any...