CVE-2003-0358

CVE-2003-0358 Eintrag aus historischen Gründen. snowcrash [email protected] https://github.com/snowcra5h/ Beschreibung Pufferüberlauf in 1 nethack 3.4.0 und früher, und 2 falconseye 1.9.3 und früher, das auf nethack basiert, ermöglicht lokalen Benutzern, Privilegien zu erlangen über eine lan...

CVE-2023-22515

CVE-2023-22515 CVE-2023-22515 Confluence - Exploit di Controllo di Accesso Non Autorizzato Descrizione della Vulnerabilità Confluence aggiunge utenti amministratore senza autorizzazione USO Compilazione 源码编译 go mod init CVE-2023-22515 go mod tidy go build -ldflags="-s -w" -trimpath -o...

cve-2015-1538-1

Incluso c'è uno script Python che genera un MP4 sfruttando la vulnerabilità 'stsc' altrimenti nota come CVE-2015-1538 1. Questa è una delle vulnerabilità più critiche che ho segnalato nella libreria Stagefright. Il risultato atteso dell'exploit è una reverse shell come utente media. Come...

CVE-2006-0450-phpBB-2.0.15-Multiple-DoS-Vulnerabilities

Neo Security Team NST® - Advisory 15 - 00/00/06 Programma: phpBB 2.0.15 Homepage: http://www.phpbb.com Versioni Vulnerabili: phpBB 2.0.15 e versioni precedenti Rischio: Alto!! Impatto: Molteplici vulnerabilità DoS. Descrizione phpBB è un potente sistema di bacheca open source completamente...

Exploit-CVE-2024-9513-NetAdmin-IAM-Allows-User-Enumeration-In-Active-Directory

शोषण शीर्षक: CVE-2024-9513 - NetAdmin IAM सक्रिय निर्देशिका में उपयोगकर्ता गणना की अनुमति देता है दिनांक: 2024-10-04 शोषण लेखक: Elizeu Das Dores ELIZEUOPAIN विक्रेता गृहपृष्ठ: https://netadmin.software/ संस्करण: 3.5 परीक्षित किया गया: 20224-10-05 CVE : CVE-2024-9513 संदर्भ:...

Shellbash-CVE-2014-6271

Shellshock - Iniezione di comandi remota CVE-2014-6271 Versione cinese Costruisci ed esegui l'ambiente vulnerabile： docker-compose build docker-compose up -d Quando visiti http://your-ip/ dovresti vedere due file: safe.cgi victim.cgi safe.cgi è generato dall'ultima versione di bash, mentre...

CVE-2026-105210 ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

CVE-2026-105210 ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

CVE-2026-105210

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

EUVD-2026-92103

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

CVE-2026-105210 ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

CVE-2026-105207 ZITADEL before 4.17.3 Account Takeover via External IdP Linking

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated...

CVE-2026-105207 ZITADEL before 4.17.3 Account Takeover via External IdP Linking

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated...

EUVD-2026-92100

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated...

CVE-2026-105207

ZITADEL versions 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 are vulnerable to an account takeover due to improper verification when linking external identity providers. The User Service V2 AddIDPLink endpoint and identify-only Login V2 sessions fail to verify a primary factor or the caller's pe...

CVE-2026-105207 ZITADEL before 4.17.3 Account Takeover via External IdP Linking

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated...

CVE-2026-105206

ZITADEL versions 3.0.0 through 3.4.15 and 4.x before 4.17.3 are vulnerable to an incorrect authorization flaw in the User Service API . The vulnerability exists because the system verifies the user.read permission against the caller's organization rather than the organization that owns the target...

EUVD-2026-92099

ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET...

CVE-2026-105206 ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service

ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET...

CVE-2026-105206 ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service

ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET...