Avaya Aura Device Services - OS Command Injection

An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier. id: CVE-2023-3722 info: name:...

Aura-State

Aura-State Prove your AI agent is injection-safe, in-spec, and won't act out of bounds — before you ship it. A design-time verifier for LLM agents — not a runtime guardrail. Import your LangGraph / CrewAI / AutoGen / MCP agent and Aura proves five things about the agent you already wrote, then...

aura

.. image:: https://cdn.sourcecode.ai/imgs/logotype.png :target: https://aura.sourcecode.ai/ ====== .. class:: center |homepageflair| |docsflair| |dockerflair| |licenseflair| |travisflair| |pypiflair| Source code auditing and static code analysis Aura is a static analysis framework developed as a...

CVE-2026-121178

Use after free in Aura in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-121178

Use after free in Aura in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-116398

Use after free in Aura in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-121178

A Use after free vulnerability in Aura impacts Google Chrome versions prior to 157.0.8103.38 . A remote attacker who has already compromised the renderer process can leverage this flaw to potentially execute arbitrary code outside the sandbox using a crafted HTML page. No specific exploit details...

aura-inspector

aura-inspector This is not an officially supported Google product. This project is not eligible for the Google Open Source Software Vulnerability Rewards Program. Introduction aura-inspector is a Swiss Army knife of Salesforce Experience Cloud testing. It facilitates in discovering misconfigured...

CVE-2026-121178: Google Chrome: Use after free in Aura in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the…

Use after free in Aura in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

poc_salesforce_lightning

PoC for Salesforce lightning Academic purposes Only. This tool dumps the data of Salesforce object through Aura lightning endpoint with the guest privilege. 雑なコードだけど許してくれい Requirement Python3 Usage $ python3 exploit.py -h usage: exploit.py -h -u URL -o OBJECTS OBJECTS ... -l -c -a AURACONTEXT -r...

CVE-2025-26892

CVE-2025-26892 – WordPress Celestial Aura Theme = 2.2 Arbitrary File Upload Authenticated 📄 Description An Unrestricted File Upload vulnerability exists in the WordPress Celestial Aura theme developed by dkszone up to version 2.2. A low-privileged authenticated user can upload arbitrary PHP files...

CLEANSTART-2024-YG32601 Use after free in Aura in Google Chrome prior to 90

Security vulnerability affects the qt5-qtwebengine package. Use after free in Aura in Google Chrome prior to 90...

pentaho-exploits

Exploits relating to https://research.aurainfosec.io/pentest/pentah0wnage Note: Some things might not work Thanks to my employer Aura Information Security for providing time for me to work on this project...

CVE-2023-3722

CVE-2023-3722 Python POC for CVE-2023-3722 Avaya Aura Device Services Unrestricted File Upload RCE. This script will use a PUT request to upload a php file with an eight-digit randomly generated filename. Then it will make a GET request to retrieve this file and parse the output to get the comman...

aura

This repository has moved to a new location: https://github.com/SourceCode-AI/aura Security Auditing and code introspection About the problem The current trend in the development is to use a lot of packages in the development phase, even if they provide only trivial functionality and consist of 1...

Aura component DoS

The Aura component vulnerability in Google Chrome and Microsoft Edge web browsers is related to memory usage after it has been freed. Exploiting this vulnerability allows a remote attacker to cause a denial of service by sending a specially crafted HTML page...

Aura component DoS

The Aura component vulnerability in Google Chrome and Microsoft Edge web browsers is related to memory usage after it has been freed. Exploiting this vulnerability allows a remote attacker to cause a denial of service by sending a specially crafted HTML page...

Aura component DoS

The Aura component vulnerability in Google Chrome and Microsoft Edge web browsers is related to memory usage after it has been freed. Exploiting this vulnerability allows a remote attacker to cause a denial of service by sending a specially crafted HTML page...

0g-aura (>=0.1.0, <=0.4.31), 0g-kit (>=1.0.0, <=1.0.9) +8123 more potentially affected by CVE-2026-114105 via adm-zip (>=0.5.3, <=0.6.0)

adm-zip NPM version =0.5.3, =0.1.0, =1.0.0, =0.1.0, =0.2.9, =1.125.0, =1.0.1, =3.6.0, =1.17.6-next.0, =1.18.4 and more Source cves: CVE-2026-114105 Source advisory: MEND:CVE-2026-114105...

0g-aura (>=0.1.0, <=0.4.31), 0g-kit (>=1.0.0, <=1.0.9) +16533 more potentially affected by CVE-2026-114104 via adm-zip (>=0.1.4, <=0.6.0)

adm-zip NPM version =0.1.4, =0.1.0, =1.0.0, =0.1.0, =0.2.9, =3.0.0-rc.0, =1.125.0, =1.2.2, =1.0.0, =1.0.0, =1.0.1, =1.0.10 and more Source cves: CVE-2026-114104 Source advisory: MEND:CVE-2026-114104...