CVE-2024-40094

CVE-2024-40094 ENF ExecutableNormalizedFields 서비스 거부 익스플로잇 이 스크립트는 graphql-java의 CVE-2024-40094 취약점을 익스플로잇하여 ExecutableNormalizedFields ENF 기반 서비스 거부를 유발합니다. 깊게 중첩된 별칭aliases을 포함한 조작된 GraphQL 인트로스펙션 쿼리를 생성하여 취약한 서버를 압도하도록 설계되었습니다. 개요 이 스크립트는 비동기 요청을 사용하여 대상 GraphQL 서버에 일련의 대규모 인트로스펙션 쿼리를 전송합니다. 쿼...

pwndbg

pwndbg pwndbg /paʊnˈdiˌbʌɡ/ is a GDB and LLDB plug-in that makes debugging suck less, with a focus on features needed by low-level software developers, hardware hackers, reverse-engineers and exploit developers. It has a boatload of features, see our Features page and CHEATSHEET feel free to prin...

quiver

Quiver : A Meta-Tool for Kali Linux Quiver is an organized namespace of shell functions that pre-fill commands in your terminal so that you can ditch your reliance on notes, copying, pasting, editing, copying and pasting again. Quiver helps you remember how to use every tool in your arsenal and...

EternalLiberty

EternalLiberty 説明 このリポジトリには、さまざまな脅威インテリジェンス企業がレポートで使用しているすべての脅威アクターの別名が含まれています。 目的 これにより、調査・検索したい脅威アクターを、各社が使用する名称から見つけたり、サンプルの属性を特定（アトリビューション）したりすることができます。 検索と脅威アクターのプロフィール Palo Alto | Atoms Playbook ---|--- IBM X-Force | 脅威アクター Hive 脅威アクター ITG Malpedia | 脅威アクター Kaspersky | 脅威アクター MITRE | 脅威アクター...

CVE-2026-101333

A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management. The issue occurs when the listener is configured to include the idp tag. An unauthenticated attacker can send requests to the identity broker login endpoint using...

UBUNTU-CVE-2026-101333

A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management. The issue occurs when the listener is configured to include the idp tag. An unauthenticated attacker can send requests to the identity broker login endpoint using...

Django-faille-CVE-2025-57833_test

Django의 별칭을 통한 SQL 인젝션 취약점 테스트 정의: 별칭이란? 별칭 은 SQL 쿼리에서 열이나 집계 결과에 부여된 이름입니다. Django에서 별칭은 annotate 또는 alias 메서드와 함께 사용되어 계산된 필드에 이름을 지정합니다. 예시: from django.db.models import Count books = Book.objects.annotatebookcount=Count'id' 여기서 bookcount는 Count'id' 결과의 별칭 입니다. 계산된 열에 대해 읽기 쉬운 이름을 검색할 수 있습니다. ...

CVE-2023-44769_ZenarioCMS--Reflected-XSS---Alias

ZenarioCMS 반사형 XSS v.9.4.59197 작성자: Sergio 설명: ZenarioCMS v.9.4.59197의 크로스 사이트 스크립팅 취약점으로 인해 로컬 공격자가 Alias의 Spare aliases로 전달되는 조작된 스크립트를 통해 임의 코드를 실행할 수 있습니다. 공격 벡터: Spare Aliases 입력값의 검증 과정에서 발생하는 스크립팅 취약점으로 인해, 사용자가 웹 페이지에 접근할 때 실행될 JavaScript 코드를 주입할 수 있습니다. POC: 패널에 로그인한 후, 관리 메뉴Administrati...

CVE-2026-92099

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own...

EUVD-2026-83510

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own...

CVE-2026-90241 iommu/vt-d: Tear down scalable-mode context on probe failure

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Tear down scalable-mode context on probe failure intelpasidsetupsmcontext walks a PCI device’s DMA aliases via pciforeachdmaalias and programs a scalable-mode context entry for each RID. For a device with a...

CVE-2026-90936 Froxlor before 2.3.7 Information Disclosure via customer_email.php

Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customeremail.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests...

Astra Linux – Vulnerability in Python-Django

A issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. Methods like QuerySet.annotate, QuerySet.alias, QuerySet.aggregate, and QuerySet.extra are vulnerable to SQL injection when column aliases are used, especially when a properly crafted dictionary is passed...

OPENSUSE-SU-2026:21812-1 Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20260902T191204 2026-09-02T19:12:04Z jscPED-11136. Go CVE Numbering Authority IDs added or updated with aliases: GO-2026-6305 CVE-2026-55834 GHSA-2wvm-8mvp-22qv GO-2026-6306 CVE-2026-55064 GHSA-44v6-7fxq-vgf4...

SUSE CVE-2026-66422

Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 throu...

CVE-2026-53509: Server-Side Request Forgery (SSRF)

CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools including ckanpackagesearch and sparqlquery that accept a baseurl parameter had the risk of making HTTP requests to arbitrary endpoints without restriction. A fix was applied to...

SUSE-SU-2026:23216-1 Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z jscPED-11136: Go CVE Numbering Authority IDs added or updated with aliases: GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv...

SUSE-SU-2026:23227-1 Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z jscPED-11136: Go CVE Numbering Authority IDs added or updated with aliases: GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv...

Exploit for Improper Privilege Management in Google Chrome

--- 3. CVE-2026-11103 – GraphQL Batching Alias Rate Limit By...

CVE-2026-67316: Improperly Controlled Modification of Object Prototype Attributes

axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases axios.get, axios.delete, axios.head, axios.options, inherited data is read via...