udpack

UDPack UDPack is an extensible generic UDP packet obfuscator. The purpose of this application is to sit in the path of a UDP data stream, and obfuscate, deobfuscate or otherwise modify the packets. Python 3.4 or above is required, since this script uses the asyncio library. Using the latest Pytho...

The vulnerability of the ReadyScript e-commerce management system, related to improper session management, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the ReadyScript e-commerce management system is related to improper session management. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the ReadyScript e-commerce management system lies in the improper implementation of the sequence of actions to be performed, which allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ReadyScript e-commerce management system is related to the improper implementation of the sequence of actions to be performed. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected informati...

The vulnerability of the platform for creating individual web applications in CRM involves a lack of measures to protect the SQL query structure, allowing attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the platform for creating individual web applications in CRM involves the failure to take measures to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected...

The vulnerability of the “REDAAM” IT-infrastructure centralized management system, related to deficiencies in authentication procedures, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the “REDAAM” IT-infrastructure centralized management system is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the Ascon.Pilot.WinService component in the Pilot-BIM data management system, which stems from the lack of authentication for a critical function, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Ascon.Pilot.WinService component in the Pilot-BIM data management system is related to the lack of authentication for a critical function. Exploiting this vulnerability allows an attacker operating remotely to compromise the confidentiality, integrity, and accessibility o...

The vulnerability of the Test IT testing management system, related to the use of default login credentials, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Test IT testing management system is related to the use of default login credentials. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the FOQUZ platform, related to the incorrect duration of a session, allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the FOQUZ platform is related to an incorrect session duration. Exploiting this vulnerability can allow attackers to compromise the confidentiality and integrity of the protected information...

The vulnerability of the FOQUZ platform, related to synchronization errors when using a shared resource, allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the FOQUZ platform is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow attackers to compromise the confidentiality and integrity of the protected information...

The vulnerability of the Enlogic SCADA system “ENTEK” virtual controller, related to the use of a password hash instead of a password for authentication, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Enlogic SCADA system “ENTEK”’s virtual controller is related to the use of a password hash instead of a password for authentication. Exploiting this vulnerability allows an intruder to compromise the confidentiality, integrity, and accessibility of the protected informati...

formal_np1sec

n+1sec のグループ鍵交換部分におけるグループ鍵の機密性の証明に関する研究。参加者が3名のみであるといった一定の制約があります。この研究は Alex Balducci と Andy Lee によって行われました。 メイン文書は gkepnormxormsimplifiedwriteup.txt です。この文書には、「手作業による証明」proof by hand と呼ばれる2つの文書と、Tamarin への入力である gkepnormxormsimplifiedcleaned.spthy...

PoC_CVE-2025-54887

PoCCVE-2025-54887 このリポジトリには、CVE-2025-54887 の Proof-of-Concept PoC エクスプロイトが含まれています。 これは ruby-jwe バージョン = 1.1.0 の脆弱性であり、暗号化された JWE の認証タグがブルートフォースされる可能性があります。これにより、機密性が失われる恐れがあり、任意の JWE を細工する手段が提供される可能性があります。 Writeup: bloglink デモンストレーションビデオ: videolink...

CVE-2018-16987

CVE-2018-16987 これは、ペネトレーションテスト中にSquash TMで発見した、機密情報の平文保存および機密情報漏洩の脆弱性です。 SquashTM Squash TMは、テストケースを管理するためのWebインターフェースです。プロジェクトへのリンク 説明 Squash TM（少なくともバージョン1.18.0まで）は、管理パネルで外部サービスのパスワードを平文で表示します。これは、HTMLソースコード内のta-server-passwordフィールドによって示されています。 詳細...

libsrtp

libSRTP の紹介 このパッケージは、Secure Real-time Transport Protocol（SRTP）、Universal Security Transform（UST）、およびそれを支える暗号カーネルの実装を提供します。SRTP APIはinclude/srtp.hに文書化されており、ライブラリは（コンパイル後に）libsrtp2.aに格納されます。 この文書は、Cisco Systems, Inc.によるオープンソースのSecure RTPライブラリであるlibSRTPについて説明します。RTP（Real-time Transport Protocol）は、RF...

CVE-2023-31594

CVE-2023-31594 IC Realtime ICIP-P2012T には、不適切なアクセス制御の脆弱性があります。 IC Realtime IP PTZ ドームカメラ ICIP-P2012 ソフトウェアバージョン: 2.420 における認証なしストリーミングチャンネル。 ライブフィード MJPEG は、公開された HTTP チャンネルを介して VLC ネットワークストリームを使用してストリーミングできます。この脆弱性は、顧客の機密性に重大な影響を与え、偵察段階（人物、資産、パスワードなどの特定）で悪用される可能性があります。 概念実証（POC） HTTP...

CVE-2023-31595

CVE-2023-31595 IC Realtime ICIP-P2012T は、オープンポートを介した不適切なアクセス制御（Incorrect Access Control）に対して脆弱です。 IC Realtime IP PTZ ドームカメラ ICIP-P2012 ソフトウェアバージョン: 2.420...

CVE-2024-21006

CVE-2024-21006 CVE-2024-21006 説明 Oracle Fusion Middleware の Oracle WebLogic Server 製品における脆弱性（コンポーネント: Core）。影響を受けるサポート対象バージョンは、12.2.1.4.0 および 14.1.1.0.0 です。容易に悪用可能なこの脆弱性により、T3、IIOP を介したネットワークアクセスを持つ認証されていない攻撃者が Oracle WebLogic Server を侵害する可能性があります。この脆弱性の攻撃が成功すると、重要なデータへの不正アクセス、または Oracle WebLogic...

AcyMailing < 10.11.1 - Unauthenticated SQL Injection

AcyMailing component for Joomla 10.11.1 contains a sql injection caused by improper input sanitization, letting attackers access unauthorized database data, exploit requires crafted input. id: CVE-2026-56292 info: name: AcyMailing 10.11.1 - Unauthenticated SQL Injection author: str4k3r severity:...

Leantime < 2.4 - Authenticated SQL Injection

Leantime is an open source project management system. A 'userId' variable in app/domain/files/repositories/class.files.php is not parameterized. An authenticated attacker can send a carefully crafted POST request to /api/jsonrpc to exploit an SQL injection vulnerability. Confidentiality is impact...

Javafaces LFI

An Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0, and 12.1.2.0.0; and the Oracle WebLogic Server component in Oracle Fusion Middleware...