CVE-2023-4357-Exploitation

CVE-2023-4357-Exploitation Projet de sécurité réseau Description La validation insuffisante des entrées non fiables dans le XML de Google Chrome antérieur à la version 116.0.5845.96 permettait à un attaquant distant de contourner les restrictions d'accès aux fichiers via une page HTML spécialemen...

CVE-2026-16639

This vulnerability affects the Drupal Internationalization Single Sign-On contrib module (versions 0.0.0 through 1.8.0 ). The module enables automatic cross-domain SSO on multilingual websites that use separate domain names per language. The root cause is insufficient validation of a short-lived ...

CVE-2026-16644

An incorrect authorization flaw in the Drupal Webform REST contrib module (which exposes webform submissions via REST endpoints) allows forceful browsing . The module does not sufficiently validate the parent webform's permissions for create, view, and update operations. The advisory classifies t...

CVE-2026-16645

Drupal PhotoSwipe (contrib module) contains a missing authorization flaw in its image gallery display formatter that allows forceful browsing of images. The module failed to sufficiently check access permissions when viewing images via the lightbox gallery formatter. Affected versions are < 3....

CVE-2026-18259

CVE-2026-18259 is an Observable Timing Discrepancy vulnerability in the Drupal Token Content Access contrib module (versions 0.0.0 through 3.1.2 ). The module, which allows site administrators to grant content access via tokens, does not sufficiently protect the access token comparison in some ca...

CVE-2026-18985

CVE-2026-18985 is an Incorrect Authorization vulnerability in the Drupal contrib module Edit in-place field (versions 0.0.0 through 2.1.1). The module provides formatters for in-place editing within Views and other displays but does not sufficiently verify access when editing entities, allowing a...

CVE-2026-79105

Improper input validation in the Mobile component of Google Chrome on iOS prior to version 152.0.7977.65 allowed a remote attacker to bypass system access restrictions by delivering a crafted HTML page. The vulnerability was classified by Chromium with a Low security severity. No exploitation det...

CVE-2026-79015

CVE-2026-79015 is an improper input validation flaw in the ServiceWorker component of Google Chrome prior to 152.0.7977.65 . A remote attacker could leverage a crafted HTML page to bypass system access restrictions . Chromium classifies the security severity as Low . The fix is available in Chrom...

CVE-2026-79108

CVE-2026-79108 affects Google Chrome prior to 152.0.7977.65 , specifically in the Web Authentication (Passkeys & Security Keys) component. A UI misrepresentation allows a remote attacker , leveraging social engineering , to bypass system access restrictions by delivering a crafted HTML page. Chro...

CVE-2026-79089

A race condition in the Transactions Platform of Google Chrome on Android prior to version 152.0.7977.65 allows a remote attacker, leveraging social engineering, to bypass system access restrictions via a crafted HTML page. The Chromium security team classified the severity as Low . The fix is av...

CVE-2026-79276

CVE-2026-79276 is an improper privilege management flaw in the FileSystem component of Google Chrome prior to 152.0.7977.65 . A remote attacker can leverage social engineering to deliver a crafted HTML page that bypasses system access restrictions. The Chromium project rates the severity as Mediu...

CVE-2026-79217

CVE-2026-79217 is an incorrect authorization vulnerability in Google Chrome for iOS , affecting versions prior to 152.0.7977.65 . The flaw resides in the Mobile component and allowed a remote attacker to bypass system access restrictions by serving a crafted HTML page. Chromium assigned a Medium ...

CVE-2026-79137

This vulnerability affects Google Chrome prior to version 152.0.7977.65 , specifically the Extensions subsystem. The root cause is an incorrect authorization flaw that allows a remote attacker, leveraging social engineering , to bypass system access restrictions through a crafted Chrome extension...

CVE-2026-79087

An injection vulnerability in Chrome Tabs in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass system access restrictions via a crafted HTML page. The Chromium project assigned a severity of Medium . Updating to version 152.0.7977.65 or later is the indicated re...

CVE-2025-30208

CVE-2025-30208 En utilisant une chaîne de requête d'import brute spéciale sur un serveur de développement Vite, un attaquant peut lire des fichiers arbitraires Résumé de la CVE Les serveurs de développement Vite antérieurs aux versions 6.2.3, 6.1.2, 6.0.12, 5.4.15 et 4.5.10 peuvent contourner les...

CVE-2026-56092

The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages...

S2-053-CVE-2017-12611

S2-053-CVE-2017-12611 Простой скрипт для эксплуатации RCE в Struts 2 S2-053CVE-2017-12611 Использование root@kitploit: exploit.py Пример root@kitploit: $ python s2-053-exploit.py "http://127.0.0.1" "name" "uname -a" Generated EXP:...

spydir

使用法: spydir.exe すべてのサブディレクトリを含むディレクトリの変更を監視します アクセス権のないファイルも含め、すべてのファイルを対象とします CVE-2007-0843 2007年1月時点 c Vladimir Dubrovin, 3APA3A http://securityvulns.com http://securityvulns.ru この手法は信頼性が低く、監査やその他の重要度の高い操作には使用しないでください。...

CVE-2026-5006

HashiCorp Vault and Vault Enterprise are vulnerable to privilege escalation via slash injection in templated policy paths . An authenticated attacker who can control an identity value referenced by a templated policy can embed / characters, which Vault interprets as additional path segments when ...

CVE-2026-77768 OpenPanel report.get Returns Any Report by Identifier Without Checking Project Access

The report.get procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned getReportByIdreportId directly. The enforceAccess middleware in packages/trpc/src/trpc.ts evaluates membership only when the input carries a projectId or organizationId key, so an input consistin...