CVE-2019-19393

Rittal CMC PU III – 保存型XSS PoC アプリケーション: Rittal CMC PU III Web管理 デバイス: CMC PU III 7030.000 ソフトウェアリビジョン: V3.11.002 から V3.15.704 まで ハードウェアリビジョン: V3.00 から V6.01 まで 攻撃タイプ: 保存型XSS 解決策: ソフトウェアリビジョン V3.17.10 以降にアップデート 概要:...

CVE-2026-84990 ntopng: Missing Authorization on System Configuration Backup Download and Listing

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/listavailablebackups.lua and scripts/lua/rest/v2/get/system/configurations/downloadbackup.lua allow any authenticated non-admin user to list and download...

Brute-Ratel-C4-Community-Kit

Brute-Ratel-C4 このリポジトリには、Brute Ratel C4 https://bruteratel.com/ 用のスクリプト、設定、および非推奨のペイロードローダーが含まれています。deprecated フォルダーに追加されたものは、BRc4 の最新リリースには含まれません。...

CVE-2013-3827

CVE-2013-3827 CVE-2013-3827 によるディレクトリトラバーサルを利用してアクセス可能な一般的な設定のためのクイック PoC チェッカー 使い方: 1. ニーズに合わせて traversal.py の内容を変更してください 2. python3 traversal.py...

tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...

tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...

tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...

tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...

CVE-2026-76438

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker with low privileges to alter configurations on an affected device. This vulnerability is due to missing authorization checks. An attacker could...

CVE-2026-76438 Cisco BroadWorks CommPilot Application Software Authorization Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker with low privileges to alter configurations on an affected device. This vulnerability is due to missing authorization checks. An attacker could...

CVE-2026-76438 Cisco BroadWorks CommPilot Application Software Authorization Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker with low privileges to alter configurations on an affected device. This vulnerability is due to missing authorization checks. An attacker could...

CVE-2026-76438

CVE-2026-76438 affects the web-based management interface of Cisco BroadWorks CommPilot Application Software , where missing authorization checks allow an authenticated, remote attacker with low privileges to send a crafted HTTP request and alter configurations on select pages . The vulnerability...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: USB: Hub – Ignoring non-compliant devices with too many configurations or interfaces Robert Morris created a test program that can cause usbhubtostructhub to dereference a NULL or inappropriate pointer. Oops: General Protection...

Astra Linux – Vulnerability in cups

OpenPrinting CUPS is an open-source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, an unsafe deserialization attack and improper validation of printer attributes could lead to a null dereference in the libcups library. This is a remote DoS...

Astra Linux – Vulnerability in OpenSSH

In OpenSSH 6.2 through 8.x, prior to version 8.8, when certain non-default configurations were used, privilege escalation could occur because supplementary groups were not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand might run with privileges...

Astra Linux – Vulnerability in exim4

Exim 4 before 4.94.2 has an improper neutralization of line delimiters, which is relevant in non-default configurations that enable Delivery Status Notification DSN. Certain uses of ORCPT= can cause a new line to be inserted into a spool header file, thereby indirectly allowing unauthenticated...

CVE-2026-82684: Missing Authorization

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization vulnerability. This could allow an attacker to extract system credentials, configurations, or flash contents...

PaperCut NG/MF Missing Authentication for Critical Function Vulnerability

PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078...

CVE-2026-51704: Improper Access Control

Incorrect access control in the setWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter mesh configurations via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-81578

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allow...