CVE-2024-3094

CVE-2024-3094 Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specifi...

-CVE-2024-3094-Vulnerability-Checker-Fixer-Public

Show Your Support If you find this script useful and it has helped you safeguard your systems against CVE-2024-3094, please consider giving it a star ⭐ . Starring this repository not only shows your support but also helps more people discover and benefit from our collective effort to improve...

xz-utils-vuln-checker

/ / / / | |/// / / / / / / / / / / / / / / //// // / / / / / / / //|| // ,/ / // // // Hare Krishna Rai 0xblurr3d / / / / / / | | / / / / / / / / / \ / / / \ / \ / / / /// / \ / / | |/ / / // / / / / / / //// / / / / // // / / , / / / / |/ ,/ // // // / // // / / //|| / // CVE-2024-3094 +...

Sicurezza-Informatica-Presentazione

What does this repository contain? This repository contains a brief research and presentation of the security flaw regarding XZ Utils for the UNIPR cybersecurity course CVE-2024-3094 Description of the flaw by Ubuntu: Malicious code was discovered in the upstream tarballs of xz, starting with...

IIS-Backdoor

IIS-Backdoor In this article I will explain how I designed a rootkit for Microsoft Internet Information Services IIS.The question is: why a backdoor in a web server? First obvious but useless answer: because we can. Ok, let us give a more clever answer. The purpose of backdooring a web sever is...

CVE-2026-110970 Lack of traffic encryption in Płatnik

Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own. This issue was fixed in metric 242 in version 10.02.002...

CVE-2024-3094

CVE-2024-3094 Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specifi...

UBUNTU-CVE-2026-55889

XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to...

CVE-2026-55889

XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to...

CVE-2026-114047

A flaw was found in FreeRDP. The FreeRDP proxy accepts untrusted target TLS certificates when no verification module is configured. A network-positioned attacker who can intercept the proxy's outbound connection can present a self-signed or wrong-hostname certificate to impersonate the RDP target...

EUVD-2026-106867

IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks...

CVE-2026-9825

IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks...

CVE-2026-9825

IBM Cyber Fraud versions 1.0.0 through 1.0.2 are affected by a vulnerability where a missing secure attribute allows sensitive cookies to be transmitted over unencrypted connections. This flaw could enable an attacker to intercept session data via network-based attacks. The issue is associated wi...

CVE-2026-9825 IBM Cyber Fraud Reachable Assertion

IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks...

CVE-2026-9825 IBM Cyber Fraud Reachable Assertion

IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks...

FreeRDP encryption issue vulnerability

Versions FreeRDP from 2.0.0 up to 3.32.0 contain an encryption vulnerability. This vulnerability arises because the proxy fails to properly validate certificates when a validation module is not configured. It accepts TLS certificates from untrusted sources. Network location attackers can intercep...

PT-2026-120143

IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks...

CVE-2026-112377

CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS private key can forward the relying party's nonce to a genuin...

EUVD-2026-104535

CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS private key can forward the relying party's nonce to a genuin...

CVE-2026-112377 CCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay Attack

CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS private key can forward the relying party's nonce to a genuin...