CVE-2025-6554

CVE-2025-6554 function leakhole let x; delete x?.y?.a; return y; let y; function pwn let hole = leakhole; %DebugPrinthole; pwn; 버그 변수 y가 선언되기 전에 접근되었습니다. 일반적으로 이는 ReferenceErrorTDZ를 발생시켜야 하지만, 구형 V8에서는 delete x?.y와 결합될 때 검사가 실패하여 내부 센티널 값인 "The Hole"을 반환했습니다. 패치 이전 V8은 TDZ를 한 번만 확인한 후, y가 유효하다고 잘...

spectre-attack-example

Spectre 공격 예제 2018년 1월 2일 CVE-2017-5753 및 CVE-2017-5715 "유령" Spectre 취약점 이용 예시 이게 뭔가요? 우리는 "The Magic Words are Squeamish Ossifrage." 라는 텍스트를 메모리에 저장하고, 취약점을 이용해 이를 읽으려고 시도합니다. 시스템이 취약하다면, 표준 출력에서 동일한 텍스트를 볼 수 있습니다. 이 코드에서, victimfunction 내의 컴파일 명령이 엄격한 프로그램 순서로 실행된다면, 해당 함수는 array1 크기 = 16이므로...

CVE-2021-24356

CVE-2021-24356 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - 구독자 + 임의 플러그인 설치 설명 플러그인의 AJAX 액션에 대한 기능 검사와 nonce 검사가 부족하여, 인증된 사용자가 취약한 사이트에 임의의 플러그인을 설치할 수 있었습니다. 사용 방법 $ python3 CVE-2021-24356.py --url http://wordpress.lan --username user --password useruser1 --slug betterlinks Getting...

DolibabyPhp

DolibabyPhp Dolibarr ERP/CRM CVE-2023-30253에 대한 인증된 RCE 익스플로잇입니다. 설치 PyPi 저장소에서 pip로 패키지를 설치하거나 GitHub에서 직접 git clone으로 소스를 가져올 수 있습니다. pip install dolibabyphp 사용법 Usage: dolibabyphp OPTIONS TARGETURL USERNAME PASSWORD COMMAND ARGS... 이 익스플로잇은 지정된 대상 URL의 Dolibarr 웹 서버에 제공된 사용자 이름과 비밀번호로 로그인합니다. ...

CVE-2026-63435

A flaw was found in Mail, an internet library for Ruby. The library's decoding of RFC 2047 encoded-words in email headers was vulnerable to an overly greedy charset capture. A remote attacker could exploit this by crafting a malformed encoded-word in an address display name or local part. This...

SpeculativeExecutionAssessment

SpeculativeExecutionAssessment 시스템이 다음에 설명된 "speculative execution" 취약점에 대해 평가합니다: CVE-2017-5715 branch target injection CVE-2017-5753 bounds check bypass CVE-2017-5754 rogue data cache load 경고: 빌드 옵션에서 "Prefer 32-bit"가 선택되어 있지 않은지 확인하십시오. 상승된 권한이 필요합니다 완화를 위해서는 다음이 필요합니다: 1. 바이러스 백신/보안 제품이 Windo...

CVE-2026-52886

パストラバーサル: startswith プレフィックスチェックのバイパス Notepad++ —session.xml の backupFilePath トラバーサルによる任意ファイル読み取り アドバイザリ GHSA: GHSA-rqfm-pw34-r7j6 CVE: CVE-2026-52886 深刻度: Moderate 影響を受けるバージョン: ........\Users\victim.ssh\idrsa 2. プレフィックス...

CVE-2026-85515 OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check

In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on the SEIPD version 1 path with no integrity check performed at all. RFC 9580 sec. 13.7 permits an implementation to release the cleartext of the fully authenticated chunks when...

CVE-2026-32475

CVE-2026-32475 PoC: Elementor Pro の認証なし任意ファイルアップロードによるRCE Elementor Pro 事前認証の任意ファイルアップロードによるリモートコード実行 CVE-2026-32475 の概念実証コードです。Elementor Pro の Forms モジュールにおける深刻な認証なし任意ファイルアップロードが、リモートコード実行に至るものです。この PoC は、同じアップロードフィールドに対して2つのファイルパートを送信します — 空の最初のエントリ（空のファイル名で UPLOADERRNOFILE...

CVE-2026-105051

Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via CPUID interception SimpleSvm.sys on AMD; hyperkd.sys and hyperhv.dll on Intel...

collision-webshell

Webshell 衝突 このリポジトリには、同じ MD5 ハッシュを持つ 2 つのファイルが含まれています: webshell.php normal.php ファイルの MD5: $ md5sum .php b719a17ae091ed45fb874c15b2d9663f normal.php b719a17ae091ed45fb874c15b2d9663f webshell.php webshell.php の Hexdump: $ hexdump -C webshell.php 00000000 3c 3f 3d 65 76 61 6c 28 24 5f 47 45 54 5b 31...

tethr

Tethr 안드로이드 테더링 프로비저닝 검사 우회 CVE-2017-0554 이 저장소는 안드로이드 7.1.2 이전 버전에서 테더 프로비저닝 검사를 우회하는 CVE-2017-0554를 증명하는 개념 증명 Tethr 앱을 위한 것입니다. 정보 블로그 게시물 Tethr 다운로드 데모 비디오...

PYSEC-2026-4146 PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

Summary PyJWT.decode/decodecomplete mutates a caller-supplied options dict in place whenever verifysignature is falsy, adding verifyexp/verifynbf/verifyiat/verifyaud/verifyiss/verifysub/verifyjti keys directly onto that object. If application code reuses the same options dict across calls a confi...

polkit-CVE-2021-3560_writeup

Try Hack Me - Polkit:CVE-2021-3560 作者: Atharva Bordavekar 难度: 信息 分数: 32 漏洞: CVE-2021-3560 我们将首先检查polkit的版本以获得更好的洞察。 apt list --installed | grep policykit-1 policykit-1/focal,now 0.105-26ubuntu1 amd64 已安装,可升级至: 0.105-26ubuntu1.1 我使用deepseek创建了一个简单的类比，帮助你更好地理解polkit的概念。 夜店保安类比 夜店: Polkit系统 夜店（VIP区）...

Rocky Linux 8 [CIQ] Security Update: openssl / openssl-debuginfo / openssl-debugsource / openssl-devel / etc Multiple Vulnerabilities (crlsa-2021_1024)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20211024 advisory. openssl: NULL pointer dereference in signaturealgorithms processing CVE-2021-3449 openssl: CA certificate check bypass with X509VFLAGX509STRICT CVE-2021-34...

AlmaLinux 9.2 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc (ALMALINUX9.2:CLSA-2025:1740645491)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1740645491 advisory. - The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an...

CVE-2026-47554

A flaw was found in nvidia-driver. Under conditions of memory pressure, the kernel mode layer improperly verifies cryptographic signatures, allowing verification checks to be bypassed. A local attacker with low privileges could exploit this vulnerability to tamper with system data or cause a Deni...

CVE-2026-92121 Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

CVE-2026-102930

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels'...

GHSA-CXF4-7MRP-VVPR Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Related public issue context, not a duplicate Closed issue 1429 "Handle non-UTF-8 paths", 2024-03-24 raised exactly this general concern and even suggested detection via pregmatch'//u', $path !== 1 -- note the reporter's suggested check explicitly compares !== 1, which would correctly treat PCRE'...