12658 matches found
EUVD-2026-90205
yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...
CVE-2026-103474 yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE
yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...
CVE-2026-103474 yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE
yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...
USN-8845-1: GVfs vulnerabilities
Keith Linneman discovered that GVfs did not properly validate data received from SFTP servers. An attacker could possibly use this issue to cause a heap buffer overflow, resulting in arbitrary code execution or a denial of service. CVE-2026-84268 It was discovered that GVfs incorrectly handled fi...
USN-8845-1 gvfs vulnerabilities
Keith Linneman discovered that GVfs did not properly validate data received from SFTP servers. An attacker could possibly use this issue to cause a heap buffer overflow, resulting in arbitrary code execution or a denial of service. CVE-2026-84268 It was discovered that GVfs incorrectly handled fi...
CVE-2026-54519
CVE-2026-54519 ai-agent-automation 在 memory APIs 中缺少所有权检查，允许跨用户的内存读取和删除。 主要公告： GHSA-qv97-83w4-ff86 研究人员致谢： @chaitanyagarware 概览 字段| 值 ---|--- CVE| CVE-2026-54519 GHSA| GHSA-qv97-83w4-ff86 项目| vmDeshpande/ai-agent-automation 包| backend 生态系统| npm 严重性| 高 CVSS| 8.8,...
Apache-Authentication-Flaw-Research-CVE-2024-38476-
🛡️ Apache 認証脆弱性の研究 CVE-2024-38476 作成者: Abanoub Ehab 🛡️ Huawei Telecommunications Student Club - AOU Apache HTTP Server におけるセマンティックあいまいさの脆弱性とそのバックエンド応答処理への影響に関する包括的な技術研究論文 📝 要約 citestartCVE-2024-38476 は Apache HTTP Server（バージョン ≤ 2.4.59）に影響を与える重大な脆弱性ですcite:...
gogs
gogs ここでは、SEED Ubuntu 16.04 VM上にラボをセットアップします。SQLインジェクションの脆弱性を悪用する前に、まずVM上にGo Git Service（GOGS）をインストールする必要があります。VMをセットアップする手順は以下の通りです。 ステップ1: データベースのインストール システムにログインしたら、以下のコマンドを実行してライブラリとリポジトリが最新であることを確認します。 $ sudo apt-get -y update バックエンドではMySQLサーバーを使用しているため、VMにインストールする必要があります。以下のコマンドでインストールできます。...
CVE-2026-51861
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py...
CentOS Linux 6 [TuxCare] Security Update: glib2 / glib2-devel / glib2-doc / glib2-static Multiple Vulnerabilities (CENTOS6:CLSA-2026:1776346717)
The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1776346717 advisory. - filecopyfallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation...
EUVD-2026-90421
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in savedownloadfile src/backend/bisheng/core/cache/utils.py:290...
CentOS Linux 8.4 [TuxCare] Security Update: libssh / libssh-config / libssh-devel Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1786012208)
The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1786012208 advisory. - A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove...
CVE-2026-51861
The software bisheng versions 2.3.0 , 2.4.0 , and 2.4.0-beta1 are vulnerable to Code Injection (CWE-94). The flaw is located within the src/backend/bisheng/api/v1/validate.py component. This vulnerability allows for unauthorized code execution, which can lead to high impact on confidentiality , i...
CVE-2026-51859
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in savedownloadfile src/backend/bisheng/core/cache/utils.py:290...
CVE-2026-51860
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/taskexec.py...
CVE-2026-51860
The bisheng software versions 2.3.0 , 2.4.0 , and 2.4.0-beta1 are vulnerable to a Directory Traversal flaw. The vulnerability exists within the src/backend/bisheng/linsight/domain/task_exec.py component. This issue allows for unauthorized access to files or directories outside of the intended sco...
EUVD-2026-90420
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/taskexec.py...
PT-2026-103610
Name of the Vulnerable Software and Affected Versions bisheng versions 2.3.0 through 2.4.0 Description A directory traversal issue exists in the save download file function located in src/backend/bisheng/core/cache/utils.py:290. Directory traversal is a flaw that allows an attacker to access file...
