CVE-2022-28346

CVE-2022-28346 Django QuerySet.annotate, aggregate, extra SQL インジェクション 環境初期化 1.python manage.py makemigrations 2.python manage.py migrate 3.访问http://x.x.x.x:8000/ 插入初始化数据 脆弱性の再現 访问http://x.x.x.x:8000/demo POC: http://x.x.x.x:8000/demo?field=demo.name" FROM "demouser" union SELECT...

CVE-2022-28346

CVE-2022-28346 PoC 影響: QuerySet.annotate、aggregate、extra における潜在的なSQLインジェクション。 インストール poetry install python manage.py makemigrations python manage.py migrate python manage.py loaddata data.json python manage.py runserver PoC ?field=poc.title" FROM "pocblog" union SELECT "-1,",sqliteversion,"3" --...

CVE-2022-28346

CVE-2022-28346 QuerySet.annotate、aggregate、extra におけるSQLインジェクション セットアップ: 初期セットアップのために ./setup.sh を実行してください データベースを初期化するためにdockerイメージを開いてください: docker exec -it containerid /bin/bash そして次のコマンドを実行してください: python manage.py makemigrations cve202228346 python manage.py migrate 次のコマンドでインスタンスを起動してください:...

CVE-2026-71891 BLS12-381 key validation accepts a public key built on a foreign curve

In Bouncy Castle for Java before 1.86, BLS12381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and ProofOfPossession verify and aggregateVerify that gate on it, accepted a public key built on a foreign ECCurve that merely shares BLS12-381's field...

EUVD-2026-92005

In Bouncy Castle for Java before 1.86, BLS12381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and ProofOfPossession verify and aggregateVerify that gate on it, accepted a public key built on a foreign ECCurve that merely shares BLS12-381's field...

CVE-2026-26198-analysis

CVE-2026-26198 — Ormar ORMにおけるSQLインジェクション Python製非同期ORMにおける重大な（CVSS 9.8）SQLインジェクション脆弱性の詳細な分析。再現、解析、修正を含む。 脆弱性の概要 Ormar は、Python向けの人気のある非同期ミニORMであり、FastAPIやStarletteと併用されることが一般的です。バージョン 0.9.9から0.22.0 には、min および max 集計メソッドにSQLインジェクションの脆弱性が存在します。 根本原因は「部分的な実装」バグです。sum と avg...

CVE-2026-55511

CVE-2026-55511: Yamcs StreamSQL 認証済みRCE CVE-2026-55511 に対する非武器化された概念実証および技術文書です。これは、Yamcs StreamSQL 集約式コンパイラにおける認証済み Java コードインジェクションの脆弱性です。 フィールド| 値 ---|--- 製品| Yamcs org.yamcs:yamcs-core アドバイザリ| GHSA-3g44-3m7x-cgg2 脆弱性の種類| CWE-94: Improper Control of Generation of Code 深刻度| Critical, CVSS 3.1:...

SUSE CVE-2026-88382

hiredis commit 29ea279 post-v1.5.0 contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser...

Linux Distros Unpatched Vulnerability : CVE-2026-88382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hiredis commit 29ea279 post-v1.5.0 contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser. CVE-2026-88382 Note that Nessus relies...

CVE-2026-88382

hiredis commit 29ea279 post-v1.5.0 contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser...

DEBIAN-CVE-2026-88382

hiredis commit 29ea279 post-v1.5.0 contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser...

CVE-2026-88382: Allocation of Resources Without Limits or Throttling

hiredis commit 29ea279 post-v1.5.0 contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser...

CVE-2026-88382

The hiredis library (commit 29ea279, post-v1.5.0) contains an uncontrolled memory allocation vulnerability within its RESP aggregate parser . This flaw allows for the allocation of resources without sufficient limits or throttling. While the vulnerability is documented across multiple security ad...

EUVD-2026-86315

hiredis commit 29ea279 post-v1.5.0 contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser...

CVE-2026-88382

hiredis commit 29ea279 post-v1.5.0 contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser...

CVE-2026-88382

hiredis commit 29ea279 post-v1.5.0 contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser...

PT-2026-98150

hiredis commit 29ea279 post-v1.5.0 contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser...

CVE-2026-88382

hiredis commit 29ea279 post-v1.5.0 contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser...

CVE-2026-86338

Ash (Elixir) field_policies were intended to prevent filter-based information disclosure by nilling forbidden field references in filters. The nilling mechanism matched only Ash.Resource.* structs (attributes) but failed to match Ash.Query.Calculation and Ash.Query.Aggregate structs, so filters r...

CVE-2026-86338: Insufficient Granularity of Access Control

Ash fieldpolicies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to nil, so a filter cannot be used as a yes/no oracle to read a value the actor cannot see. This...