juicy-potato

Juicy Potato abusando de los privilegios dorados Una versión azucarada deRottenPotatoNG, con un poco de jugo, es decir, otra herramienta de Elevación de Privilegios Local, desde una Cuenta de Servicio de Windows a NT AUTHORITY\SYSTEM Resumen RottenPotatoNG y sus variantes aprovechan la cadena de...

invoker

Invoker Utilidad de pruebas de penetración y herramienta de evaluación antivirus. Construido con Visual Studio Community 2022 v17.5.4 64 bits y probado en Windows 10 Enterprise OS 64 bits. Hecho con fines educativos. ¡Espero que sea de ayuda! Este repositorio comenzó a tener firmas conocidas y no...

CVE-2026-104660

Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 Windows only lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCO...

CVE-2026-103011 Heap-based Buffer Overflow in hMailServer

Heap-based buffer overflow in the legacy Blowfish encryption routine BlowFishEncryptor::Encode, called by EncryptToString in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows an authenticated mailbox user to cause a denial of service service crash, and possibly other unspecified impact. In...

EUVD-2026-94833

Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 Windows only lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCO...

CVE-2026-104660 Missing Authorization in hMailServer

Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 Windows only lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCO...

CVE-2026-104660 Missing Authorization in hMailServer

Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 Windows only lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCO...

CVE-2026-104660

Progressive Robot hMailServer versions 6.0.0 through 6.3.5 (Windows) are vulnerable to a missing authorization flaw in its COM objects. The service registers COM classes without DCOM access or launch permissions and fails to use a security descriptor during CoInitializeSecurity, allowing local in...

CVE-2026-104660: Missing Authorization

Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 Windows only lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCO...

CVE-2026-103011: Heap-based Buffer Overflow

Heap-based buffer overflow in the legacy Blowfish encryption routine BlowFishEncryptor::Encode, called by EncryptToString in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows an authenticated mailbox user to cause a denial of service service crash, and possibly other unspecified impact. In...

alphafold3-pytorch-lightning-hydra (>=0.2.126, <=0.4.28), cosyvoice-package (0.0.2) +7 more potentially affected by CVE-2026-106440 via hydra-optuna-sweeper (1.2.0)

hydra-optuna-sweeper PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on hydra-optuna-sweeper and may be impacted: - alphafold3-pytorch-lightning-hydra =0.2.126, =0.0.1, =0.0.1.dev4, =0.4.0, =2.2.0, =2.9.0 - reverse-distillation 0.1.0...

[SECURITY] Fedora 45 Update: ocaml-camlidl-1.13-9.fc45

CamlIDL is a stub code generator and COM binding for Objective Caml. CamlIDL comprises two parts: A stub code generator that generates the C stub code required for the Caml/C interface, based on an MIDL specification. MIDL stands for Microsoft's Interface Description Language; it looks like C...

HPESBHF05163 rev.1 - HPE Integrated Lights-Out (iLO) 7 Using COM, User Validation Failure Vulnerability

Potential Security Impact: Remote: User Validation Failure SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Integrated Lights-Out 7 iLO 7 1.25.00 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2026-79820 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H ...

CVE-2026-100761

Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157...

org.webjars.npm:github-com-wavesoft-local-echo (0.2.0), org.webjars.npm:launch-editor (>=2.2.1, <=2.14.1) +2 more potentially affected by CVE-2026-102422 via org.webjars.npm:shell-quote (1.10.0)

org.webjars.npm:shell-quote MAVEN version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:shell-quote and may be impacted: - org.webjars.npm:github-com-wavesoft-local-echo 0.2.0 - org.webjars.npm:launch-editor =2.2.1, =2.14.1 -...

PT-2026-102708

Name of the Vulnerable Software and Affected Versions Balbooa Forms versions prior to 2.4.3.4 Description An unauthenticated remote code execution RCE issue exists in the com baforms component. The software allows administrators to define PHP code that executes after a public form submission, whi...

Criminals turn placeholder domain into ClickFix trap

A domain that has long appeared in software documentation, code examples, and developer test material is now being used to push a ClickFix attack against Windows users. A placeholder domain stands in for a website in an example. The best-known is probably example.com. Another, third-party.com, ha...

Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content

The "third-party.com" domain, commonly used as a documentation placeholder, has been observed serving a ClickFix lure to Windows browsers while displaying a harmless decoy to other users. "third-party.com has been a generic documentation placeholder for years, the same role example.com plays,"...

PT-2026-97512

Name of the Vulnerable Software and Affected Versions Easy Store extension versions 1.0.0 through 3.0.0 Description The product review submission endpoint 'index.php?option=com easystore&task=product.addReview' fails to verify anti-CSRF tokens because the check was commented out in the code. This...

PT-2026-97514

Name of the Vulnerable Software and Affected Versions Easy Store versions 1.0.0 through 3.0.0 Description An authenticated administrator can perform a SQL Injection through the coupon bulk update task. The issue occurs because the application takes input IDs and directly concatenates them into ra...