Debian dsa-6503 : thunderbird - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6503 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6503-1 [email protected] https://www.debian.org/securit...

Sandbox bypass vulnerability in script-security

script-security provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Groovy casts a collection to another type using the elements of that collection, either passing them to a constructor of that type or casting eac...

RHEL 9 : gstreamer1-plugins-base (RHSA-2026:67891)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67891 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a...

Classpath approval bypass vulnerability in script-security

script-security allows Groovy scripts to load classpath entries from JAR files, which administrators must approve before any script is allowed to use them. script-security 1415.v9af9b3ac253d and earlier automatically approves the classpath entries in an item configuration when a user with...

CVE-2026-79298

CVE-2026-79298 is an incomplete remediation of the UEFI Secure Boot bypass originally disclosed as CVE-2024-7344 in Howyar SysReturn (NetCopy feature). The Microsoft-signed BOOTia32.efi IA-32 bootloader retained its custom RxPE PE loader, which loads an unsigned payload from cloak32.dat (ALRM for...

PT-2026-93348

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get iodd port info endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...

PT-2026-93278

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remot...

CVE-2026-51990

An issue in Sogou Sogou Input Method 16.3.0.3498 fixed in 16.3.0.3498 allows a remote attacker to execute arbitrary code via the bizhelper.exe component...

Google Chrome Authorization Vulnerability (CNVD-2026-37841)

Google Chrome is a free web browser developed by Google Inc. Google Chrome has a licensing vulnerability, which stems from the lack of authorization verification in the Extensions component. Attackers can exploit this vulnerability to execute arbitrary code outside the sandbox through specially...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Snapcast vulnerability (USN-8767-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8767-1 advisory. It was discovered that Snapcast incorrectly handled crafted JSON-RPC requests. A remote attacker could possibly use this issue to execute...

Important: postgresql:18 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: SQL injection in pgcreatesubscriber allows arbitrary SQL execution as superuser CVE-2026-6476 postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector an...

cve-2023-30212

cve-2023-30212 PoC para CVE-2023-30212 usando Docker Configuración del entorno CVE-2023-30212 e informe PoC 📌 Resumen Este informe contiene la configuración directa de un entorno web vulnerable basado en Docker para la vulnerabilidad CVE-2023-30212 no disponible en Vulhub, y la demostración de...

CVE-2022-20607

CVE-2022-20607 En el firmware celular Pixel, existe una posible escritura fuera de los límites debido a la falta de una verificación de límites. Esto podría conducir a la ejecución remota de código con autenticación LTE necesaria. No se necesita interacción del usuario para la explotación...

CVE-2023-47268

Ejecución de Código Arbitrario en PrusaSlicer Escalada de privilegios usando un archivo .3mf con una versión vulnerable de prusaslicer. Asegúrate de poder ejecutar prusaslicer usando sudo. Linux 1.Descarga los archivos 2.Cambia la IP y PORT en exploit.sh 3.Asegúrate de tener exploit.sh en el...

CVE-2013-1081

Este script aprovecha una inclusión de archivos locales LFI que existe en Novell Zenworks Mobile Device Management. Módulos de Metasploit - msf use auxiliary/scanner/http/novellmdmcreds msf auxiliarynovellmdmcreds show options Module options auxiliary/scanner/http/novellmdmcreds: Name Current...

CVE-2026-41089

CVE-2026-41089 root@kitploit: ██████╗██╗ ██╗███████╗ ██╗ ██╗ ██╗ ██████╗ ██████╗ ██╔════╝██║ ██║██╔════╝ ██║ ██║███║██╔═████╗██╔═████╗ ██║ ██║ ██║█████╗ ███████║╚██║██║██╔██║██║██╔██║ ██║ ╚██╗ ██╔╝██╔══╝ ██╔══██║ ██║████╔╝██║████╔╝██║ ╚██████╗ ╚████╔╝ ███████╗ ██║ ██║ ██║╚██████╔╝╚██████╔╝ ╚═════...

ExploitScript-CVE-2023-46604

ExploitScript-CVE-2023-46604 Descargo de responsabilidad Este repositorio contiene código de prueba de concepto para CVE-2023-466064 y está destinado estrictamente a fines educativos. Los autores y colaboradores no respaldan ninguna actividad ilegal. La información aquí presentada es para fines...

CVE-2021-44228

Ejemplo de CVE-2021-44228 Ejemplo de construcción de contenedor vulnerable para CVE-2021-44228. NO USAR PARA NADA QUE NO SEA PRUEBAS DE SEGURIDAD ALTAMENTE CONTROLADAS. Este repositorio contiene una aplicación de ejemplo que utiliza deliberadamente una dependencia con una peligrosa vulnerabilidad...

CVE-2022-30292

CVE-2022-30292 Descripción Esta vulnerabilidad es el desbordamiento de búfer basado en montón en la función threadcall en Squirrel 3.2 y versiones anteriores. Está causada por la falta de la llamada a la función sqreservestack. Esta vulnerabilidad conduce a una denegación de servicio DoS del...

CVE-2022-26810

Exploit RCE CVE-2022-26809 Descripción de la CVE La CVE-2022-26809 es una debilidad en un componente central de Windows RPC que obtuvo una puntuación CVSS de 9.8 no sin razón, ya que el ataque no requiere autenticación y puede ejecutarse remotamente a través de la red, y puede resultar en la...