1891 matches found
DLLHijackHunter
DLLHijackHunter By ProjectMerai Automated DLL Hijacking Discovery, Validation, and Confirmation Turning local misconfigurations into weaponized, confirmed attack paths. Overview DLLHijackHunter is an automated Windows DLL hijacking detection tool that goes beyond static analysis. It discovers,...
XWiki DeleteApplication - Cross-Site Scripting
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack...
CVE-2023-36644
== Affected Software %hardbreaks Vendor: ITB-GmbH Affected Products: TradePro v9.5 Component: Printmail Plugin Confirmed: yes == Attack Vector %hardbreaks Type: Incorrect Access Control Access-Type: Remote Impact: Information Disclosure Incorrect Access Control in the printmail plugin in ITB-GmbH...
XSSYA
XSSYA-V2.0 has been Released - check https://github.com/yehia-mamdouh/XSSYA-V-2.0 XSSYA is a Cross Site Scripting Scanner & Vulnerability Confirmation Working in two Methods • Method number 1 for Confirmation Request and Response • Method number 2 for Confirmation Execute encoded payload and sear...
CVE-2026-87488
creationtimestamp| type| source ---|---|--- 2026-09-10 00:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv4surdd3h2b 2026-09-10 04:48:22+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260910 2026-09-10 15:07:08+00:00| seen|...
CVE-2026-77974
After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through an unauthenticated and unsigned update channel...
EUVD-2026-75056
After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through an unauthenticated and unsigned update channel...
CVE-2026-81741 Groundhogg < 4.7.2 - Open Redirect via 'redirect_to' Parameter
The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its email preference confirmation flow to the site's own host, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL by way of a crafte...
EUVD-2026-74709
The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its email preference confirmation flow to the site's own host, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL by way of a crafte...
PT-2026-88316
The permanent fix is 26.6.5, but out-of- maintenance on-prem customers may need to renew before they can install it. Temporary mitigation is to disable TransferFiles. Fair enough for features and support. Less sure about paying for a Critical security fix in software already purchased. Curious wh...
CVE-2026-82584 Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel an anti-typosquatting safeguard listing a package's hex...
EEF-CVE-2026-82584 Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata
Summary Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel an anti-typosquatting safeguard listing a package's...
CVE-2026-82584
ash-project igniter (an Elixir build tool) is vulnerable to terminal escape sequence injection in its mix igniter.install confirmation panel. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal...
CVE-2026-82584 Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel an anti-typosquatting safeguard listing a package's hex...
CVE-2026-86504
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution...
CVE-2024-9166
CVE-2024-9166 Vulnerability Scanner A Python-based tool to scan websites for the CVE-2024-9166 vulnerability, which is one of the most recent ones at the moment of publishing this repository.. It checks for vulnerable patterns, tests the vulnerability to confirm it, and logs results to a file. I'...
EUVD-2026-72520
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution...
CVE-2026-86504
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution...
CVE-2026-86504
JetBrains IntelliJ IDEA versions prior to 2026.2.2 are affected by a vulnerability where a missing project-trust confirmation before building a Dev Container allows host-level code execution . The flaw requires local access and user interaction but no prior privileges, yielding HIGH impact on con...