CVE-2019-16784-POC

CVE-2019-16784 POC これは、--onefile オプションに存在する Windows PyInstaller バージョン 3.6 未満の脆弱性に対する私のPOCです。攻撃者は、pyinstaller バイナリで使用される Python インタプリタ DLL がインポートする DLL をハイジャックすることで、コマンド実行や可能性として LPE を達成できます。脆弱性と悪用プロセスの簡単な説明を以下に示します。Alter Solutions が脆弱性を発見し、PagedOut 3 PDF の 55 ページ にその発見について執筆してくれたことに感謝します。 脆弱性...

GHSA-3WXW-XV34-2FRG GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)

Summary TagReference.create forwards a caller-influenced positional reference value into git tag without it ever being inspected by the unsafe-option guard, allowing an arbitrary file read the file's contents are returned in-band as the annotated tag message. This is an incomplete-fix bypass of...

CVE-2026-73619 GitPython before 3.1.57 Arbitrary File Read via Repo.archive()

GitPython before 3.1.57 contains an incomplete denylist in the unsafegitarchiveoptions guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive to read arbitrary files from the filesystem and include them in the returned archive...

CVE-2026-41392

OpenClaw has a vulnerability (CVE-2026-41392) where exec allowlist matching can be bypassed by shell init-file wrapper invocations. Affected product: OpenClaw before 2026.3.31. Attack path involves using shell options such as --rcfile, --init-file, and --startup-file to load attacker-controlled i...

CVE-2026-40098

Magento Long Term Support LTS is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the shared wishlist add-to-cart endpoint authorizes access with a public...

openssl-encrypt has visible password in process list via --password CLI argument

Summary Passwords passed via the --password / -p CLI argument in opensslencrypt/modules/cryptclisubparser.py at lines 150-154 are visible to any user on the system via ps aux or /proc/pid/cmdline. Affected Code python subparser.addargument "--password", "-p", help="Password will prompt if not...

cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive

A flaw was found in cmd/go. An attacker can exploit this by building a malicious Go source file that uses the 'cgo pkg-config:' directive. This allows the attacker to write to an arbitrary file with partial control over its content, by providing a '--log-file' argument to the pkg-config command...

AZL-78935 CVE-2025-61731 affecting package golang 1.25.7-1

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a...

BIT-FLUENT-BIT-2025-12972 CVE-2025-12972

Fluent Bit outfile plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause...

CVE-2025-12972

Fluent Bit outfile plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause...

Improper Removal of Sensitive Information Before Storage or Transfer

Overview Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer in the form of registry credentials in JSON output files. When registry authentication is configured, an attacker can obtain registry credentials or other values e.g...

PT-2025-48043

Name of the Vulnerable Software and Affected Versions Grype versions 0.68.0 through 0.104.0 Description Grype, a vulnerability scanner for container images and filesystems, contains a flaw where registry credentials can be improperly included in the output of a scan. This occurs when registry...

EUVD-2025-198810

Fluent Bit outfile plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause...

CVE-2025-12972

The Fluent Bit logging tool's out_file plugin is vulnerable to a path traversal vulnerability (CVE-2025-12972 ) because it fails to properly sanitize tag values when deriving output filenames. If the File option is omitted, the plugin uses untrusted tag input to construct file paths, allowing an ...

CVE-2025-12972 CVE-2025-12972

Fluent Bit outfile plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause...

CVE-2025-12972 CVE-2025-12972

Fluent Bit outfile plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause...

PT-2025-47922

Name of the Vulnerable Software and Affected Versions Fluent Bit versions prior to 4.1.1 Description The out file plugin in Fluent Bit does not properly sanitize tag values when creating output file names. If the File option is not specified, the plugin utilizes tag input, which is considered...

Linux Distros Unpatched Vulnerability : CVE-2014-0212

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - qpid-cpp: ACL policies only loaded if the acl-file option specified enabling DoS by consuming all available file descriptors CVE-2014-0212 Note that Nessus reli...

SUSE CVE-2006-2427

freshclam in 1 Clam Antivirus ClamAV 0.88 and 2 ClamXav 1.0.3h and earlier does not drop privileges before processing the config-file command line option, which allows local users to read portions of arbitrary files when an error message displays the first line of the target file...

SUSE CVE-2020-17525

Subversion's modauthzsvn module will crash if the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option and a client sends a request for a non-existing repository URL. This can lead to disruption for users of the service. This issue was fixed in...