build.prop

Pixel Prop Builder : Conversion simplifiée des OTA en build.prop Extrayez et gérez facilement les propriétés système des mises à jour OTA Pixel avec cette suite d'automatisation robuste. Conçue pour les développeurs et les passionnés, elle simplifie le processus d'accès et de personnalisation des...

react

Извлечение данных из внутренностей React Этот инструмент представляет собой быстрый и грязный пользовательский скрипт для Tampermonkey, который копает на пару уровней вглубь любой React-страницы и ищет одну или несколько фраз, заданных пользователем. Инструмент позволяет легко найти нужное место ...

rbndr

rbndr Simple DNS Rebinding Service rbndr is a very simple, non-conforming, name server for testing software against DNS rebinding vulnerabilities. The server responds to queries by randomly selecting one of the addresses specified in the hostname and returning it as the answer with a very low ttl...

pytm

pytm: A Pythonic framework for threat modeling Introduction Traditional threat modeling too often comes late to the party, or sometimes not at all. In addition, creating manual data flows and reports can be extremely time-consuming. The goal of pytm is to shift threat modeling to the left, making...

pftriage

pftriage pftriage — это инструмент, помогающий анализировать файлы в процессе триажа вредоносных программ. Он позволяет аналитику быстро просматривать и извлекать свойства файла, чтобы облегчить процесс триажа. Инструмент также имеет функцию анализа, которая может обнаруживать распространённые...

CVE-2023-23138

ruby-rail-properties CVE-2023-23138 루비 온 레일즈 속성 잘못된 구성에 대한 간략한 개요입니다. 때때로 개발자들은 이 엔드포인트 /rails/info/properties를 비활성화하는 것을 잊어버립니다. 이 엔드포인트가 호스트에서 활성화된 경우, 공격자는 다음 정보의 일부/전체를 볼 수 있습니다: 애플리케이션 루트 환경 모드 데이터베이스 어댑터 데이터베이스 스키마 버전 Ruby 버전 RubyGems 버전 Rack 버전 Rails 버전 JavaScript 런타임 Active Record 버전 Acti...

CVE-2026-104183 stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named proto invokes the inherited setter and causes parsed object prototype replacemen...

CVE-2026-58415 Apache HTTP Server: mod_dav_fs property database read access

Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects...

EUVD-2026-81598

vm2: vm.freeze/vm.readonly bypass via accessor descriptor...

CVE-2022-22965-Spring4Shell-Security-Operations-Analysis

CVE-2022-22965 — Анализ операций безопасности Spring4Shell Практическая симуляция Центра операционной безопасности SOC, в рамках которой я выполнял роль аналитика информационной безопасности, реагирующего на активную попытку эксплуатации уязвимости Spring4Shell. Этот репозиторий документирует...

AlmaLinux 9.2 [TuxCare] Security Update: libinput / libinput-devel / libinput-test / libinput-utils (ALMALINUX9.2:CLSA-2026:1784017931)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784017931 advisory. - In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to...

USN-8856-1 kdenlive, mlt vulnerability

It was discovered that Kdenlive allowed dangerous proxy parameters when processing attacker-controlled project files. An attacker could use this to execute arbitrary commands via the MLT framework's ante/post consumer properties...

USN-8856-1: Kdenlive, MLT vulnerability

It was discovered that Kdenlive allowed dangerous proxy parameters when processing attacker-controlled project files. An attacker could use this to execute arbitrary commands via the MLT framework's ante/post consumer properties...

CVE-2026-100243 Stored XSS in WikiSEO author and image properties on action=info

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - WikiSEO Extension allows Stored XSS. This issue affects Mediawiki - WikiSEO Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100243 Stored XSS in WikiSEO author and image properties on action=info

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - WikiSEO Extension allows Stored XSS. This issue affects Mediawiki - WikiSEO Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100243

The Wikimedia Foundation Mediawiki - WikiSEO Extension is vulnerable to Stored Cross-Site Scripting (XSS) due to the improper neutralization of input during web page generation. Specifically, the vulnerability exists in the author and image properties when accessed via action=info . This issue af...

CVE-2026-97395

Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata. In versions 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use thos...

CVE-2026-97395: Undefined Security Weakness

Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata. In versions 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use thos...

CVE-2026-96740 Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

CVE-2026-96740

A vulnerability exists in the StreamsHub Console for Apache Kafka where tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys. This flaw allows a Console CR author to set config....