1021 matches found
cve-2022-42889-intercept
cve-2022-42889-intercept Java 11 미만 버전은 주의가 필요합니다. 더 높은 버전에서는 Javascript 인터프리터가 제거되었습니다. 이번 방안은 Java 8을 대상으로 합니다. JVM 시작 매개변수와 jps pid를 통해 불법 매개변수를 차단합니다. 빠른 시작 -----------------------load...... cve-2022-42889 check start cve-2022-42889 isdeepmatch org.apache.commons.text.StringSubstitutor...
xerial__sqlite-jdbc_CVE-2023-32697_3-41-2-1
SQLite JDBC Driver SQLite JDBC は、Java で SQLite データベースファイルへのアクセスおよび作成を行うためのライブラリです。 SQLiteJDBC ライブラリは、Windows、macOS、Linux などの主要 OS 向けのネイティブライブラリが単一の JAR（Java Archive）ファイルにまとめられているため、設定は一切不要です。 使用方法 ➡️ より多くの使用例と設定については、USAGE.md を参照してください。 SQLite JDBC は、JDBC API を通じて SQLite...
CVE-2026-104450
YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action tools/attach/actions/pointimage.php, which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering...
CVE-2026-104450 YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action
YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action tools/attach/actions/pointimage.php, which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering...
CVE-2026-104450 YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action
YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action tools/attach/actions/pointimage.php, which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering...
CVE-2026-104450
YesWiki versions before 4.6.7 are vulnerable to a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php ). This flaw allows unauthenticated attackers to bypass write Access Control List (ACL) checks by sending POST requests with pagetag, title, and description f...
EUVD-2026-91461
YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action tools/attach/actions/pointimage.php, which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering...
CVE-2026-104450 YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action
YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action tools/attach/actions/pointimage.php, which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering...
shouganaiyo-loader
shouganaiyo-loader：Java Agent 的强制注入 shouganaiyo-loader 是一个基于 Frida 的跨平台 Node.js 命令行工具，它强制 Java 进程加载 Java/JVMTI agent，无论 JVM 是否已禁用 agent attach API。 安装 $ sudo npm install -g shouganaiyo-loader 从源码构建 $ git clone https://github.com/nccgroup/shouganaiyo-loader $ cd shouganaiyo-loader $ npm install $...
CVE-2026-67401
CVE-2026-67401 cPanel EmailTrack における SQL インジェクション。メール権限を持つ認証済み cPanel ユーザーが、SQLite の ATTACH DATABASE を介して root として任意のファイルを書き込めます。root 到達までに必要なリクエストは 1 回です。実環境でのテストは未実施で、コードは公開情報と基本的な差分解析のみから組み立てられています。研究者として十分な調査を行い、試した上で PR による修正を送ってください。 2026年9月8日のパッチ以前のすべての cPanel/WHM ビルドに影響します。 必要なもの...
CVE-2026-102371
In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument pro attach . On systems where /proc is mounted without...
Linux Distros Unpatched Vulnerability : CVE-2026-90351
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed If the WED attach for the primary PCIe function fails, the probe path still attached...
CVE-2026-90351 wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed If the WED attach for the primary PCIe function fails, the probe path still attached wedhif2 for the secondary function, leaving the device in an...
CVE-2026-50006
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server proces...
CVE-2026-16147
The ITE IT82xx2 USB device-controller driver drivers/usb/udc/udcit82xx2.c mishandles multi-packet OUT transfers on non-control endpoints. In workhandlerout the active transfer buffer is obtained with udcbufpeek which does not dequeue it; when a full max-packet-size packet arrives but the buffer...
EUVD-2026-77809
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server proces...
CVE-2026-50006 Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server proces...
CVE-2026-50006
CVE-2026-50006 affects Anyquery (github.com/julien040/anyquery), an SQL query engine built on SQLite. In server mode prior to 0.4.5 , the MySQL-compatible port forwards unauthenticated SQL to SQLite without restricting ATTACH DATABASE filesystem targets. A remote, unauthenticated attacker can spe...
CVE-2026-50006 Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server proces...
CVE-2026-50006 Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server proces...