CVE_2022_38181_Raven

CVE-2022-38181 用エクスプロイト - FireTV 第2世代 Cube これはセキュリティ研究者 Man Yue Mo 氏の Pixel 6 POC CVE202238181 用 のフォークです。彼の詳細な脆弱性解説は こちら をご覧ください。FireOS の 32 ビットユーザースペースと、第2世代 Cube の古い Bifrost ドライバー r16p0 および Linux カーネル 4.9.113 バージョンに対応するために変更が加えられています。この POC は ARM Mali カーネルドライバーのバグを悪用して任意のカーネルコード実行を達成し、SELinux...

CVE_2022_38181_Gazelle

CVE-2022-38181용 FireTV 3세대 Cube에서 실행되는 익스플로잇 이것은 보안 연구원 Man Yue Mo의 Pixel 6 POC를 CVE-2022-38181에 맞게 포크한 것입니다. 취약점에 대한 자세한 분석은 여기에서 확인할 수 있습니다. FireOS의 32비트 사용자 공간에 맞게 변경되었습니다. 이 POC는 ARM Mali 커널 드라이버의 버그를 악용하여 임의의 커널 코드 실행을 달성하고, 이를 사용하여 SELinux를 비활성화하고 루트 권한을 얻습니다. 다음 명령어를 사용하여 ndk-21의 clang으로...

CVE_2022_46395_Raven

FireTV 第2世代 Cube で実行する CVE-2022-46395 のエクスプロイト これは、セキュリティ研究者である Man Yue Mo 氏による CVE-2022-46395 のPixel 6 POCのフォークです。脆弱性の詳細な解説はこちらで読めます。FireOS の32ビット・ユーザースペースに対応するための変更が加えられています。この POC は ARM Mali カーネルドライバーのバグを悪用して任意のカーネルコード実行を達成し、それを利用して SELinux を無効化し root を取得します。 このエクスプロイトは...

CVE-2026-93587

A flaw was found in ImageMagick. A local user, by supplying a specific command line option to the PCD, CUBE, or HALD image decoders, can bypass configured resource limits. This policy bypass allows for extra memory allocation, enabling the user to exceed the intended memory policy limit. The most...

CVE-2013-3651

CVE-2013-3651 PoC - EC-CUBE 2 Using Require Python 3 Exec root@kitploit: $ python poccve20133651.py - e.g. $ python poccve20133651.py http://127.0.0.1:9000/ Result: Vulnerable! PoC 脆弱性 | ECサイト構築・リニューアルは「ECオープンプラットフォームEC-CUBE」 https://www.ec-cube.net/info/weakness/weakness.php?id=49 Reference...

CVE-2021-20717

CVE-2021-20717-EC-CUBE-XSS NVD 説明 EC-CUBE 4.0.0 から 4.0.5 におけるクロスサイトスクリプティングの脆弱性により、リモートの攻撃者が EC-CUBE を使用して作成された EC サイトの特定の入力フィールドに特別に細工されたスクリプトを注入する可能性があります。その結果、管理者の Web ブラウザ上で任意のスクリプトが実行される可能性があります。 セットアップ 1. EC Cube のクローン root@kitploit: git clone https://github.com/EC-CUBE/ec-cube.git -b 4.0.5...

UBUNTU-CVE-2026-93587

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD and, per the upstream advisory, CUBE and HALD coder: when a specific command line option is supplied, the decoder does not check a configured resource limit, which can result in extra memory allocation. A local...

CVE-2026-93587: Uncontrolled Resource Consumption

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD and, per the upstream advisory, CUBE and HALD coder: when a specific command line option is supplied, the decoder does not check a configured resource limit, which can result in extra memory allocation. A local...

CVE-2026-83015

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Cube Manager. Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleToo...

CVE-2026-83014

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Cube Manager. Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

EUVD-2026-79343

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Cube Manager. Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleToo...

CVE-2026-83015

A vulnerability in Oracle PeopleSoft Enterprise PeopleTools (component: Cube Manager ) affects supported versions 8.61–8.63 . The flaw allows a low-privileged, local attacker with logon access to compromise the application, resulting in full confidentiality, integrity, and availability impact (i....

EUVD-2026-79342

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Cube Manager. Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

CVE-2026-83014

CVE-2026-83014 affects the Cube Manager component of Oracle PeopleSoft Enterprise PeopleTools , versions 8.61–8.63 . A low-privileged attacker with network access via HTTP can exploit this vulnerability to cause unauthorized creation, deletion, or modification of data (high integrity impact) and ...

CVE-2026-83015: Improper Access Control

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Cube Manager. Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleToo...

PT-2026-92539

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Cube Manager. Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleToo...

PT-2026-92538

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Cube Manager. Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

CVE-2026-83014: Improper Access Control

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Cube Manager. Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

CVE-2026-72570

A stored cross-site scripting XSS vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters...

CVE-2026-72570

CVE-2026-72570 affects the project cube-root/directory-serve up to version 1.3.7. The vulnerability is a stored XSS : uploading a file with a crafted filename containing HTML attribute-breaking characters allows the attacker to inject arbitrary JavaScript into the web interface. The root cause is...