CVE-2024-4879

CVE-2024-4879 CVE-2024-4879.py هو سكربت Python مصمم لاكتشاف ثغرات أمنية محددة في نُسخ ServiceNow وسحب تفاصيل اتصال قاعدة البيانات في حال العثور على الثغرة. هذه الأداة مفيدة بشكل خاص للباحثين في الأمن ومختبري الاختراق. الميزات يفحص عناوين URL بحثًا عن ثغرة محددة في ServiceNow. يسحب تفاصيل اتصال...

CVE-2024-4879

CVE-2024-4879 CVE-2024-4879.py는 ServiceNow 인스턴스에서 특정 취약점을 감지하고, 취약점이 발견되면 데이터베이스 연결 세부 정보를 덤프하도록 설계된 Python 스크립트입니다. 이 도구는 보안 연구원과 침투 테스터에게 특히 유용합니다. 기능 ServiceNow의 특정 취약점에 대해 URL을 스캔합니다. 취약점이 감지되면 데이터베이스 연결 세부 정보를 덤프합니다. SSL 경고 및 요청 시간 초과를 처리합니다. 색상으로 구분된 결과와 함께 명확한 콘솔 출력을 제공합니다. 요구 사항 Python 3....

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

CVE-2023-38646

CVE-2023-38646 أداة استغلال ثغرة CVE-2023-38646 في Metabase 0.46.6 تستغل هذه الأداة ثغرة أمنية CVE-2023-38646 في منصة برمجية. تتيح الثغرة تنفيذ أوامر عن بُعد عبر طلب مُصمم بعناية، من خلال استغلال سوء التعامل مع سلسلة اتصال قاعدة البيانات. نظرة عامة تقوم الأداة بما يلي: جلب رمز الإعداد setup token...

After Veeam ONE 13.1.0.7034 Upgrade: No connection could be made because the target machine actively refused it. (localhost:2743)

Article Applicability The issue described in this article only occurs for deployments in which Veeam ONE was installed to a folder other than the default C:\Program Files\Veeam\Veeam ONE\ path. Challenge After Veeam ONE is upgraded to version 13.1 build 13.1.0.7034, reports cannot be generated an...

PaperCut MF < 24.1.9.76515 / 25.x < 25.0.12.76509 / 26.x < 26.0.4.76507 Multiple Vulnerabilities

The version of PaperCut MF installed on the remote Windows host is prior to 24.1.9.76515 or 25.x prior to 25.0.12.76509, or 26.x prior to 26.0.4.76507. It is, therefore, affected by the following vulnerabilities: - An authentication bypass vulnerability exists in the web management interface due ...

CVE-2026-59654

Apache CloudStack's scoped global configuration functionality suffers from a resource leak (database connections not released after their effective lifetime), affecting modules such as Quota and Host-HA on the management server. Over time, the accumulated leak can lead to an eventual denial of se...

CVE-2026-59654 Apache CloudStack: DoS caused by database connections leak

Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service DoS scenari...

CVE-2026-42537

Remote Code Execution via JDBC URL Injection in Apache Ranger = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...

EUVD-2026-54488

Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw...

EUVD-2026-49567

Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value...

CVE-2026-56747

Cribl Stream before 4.18.2 is affected by an improper control of code generation in the JSON Pointer-to-accessor compiler. The vulnerability allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pa...

How to Export Veeam Backup for Salesforce Data to Cloud or Local Storage

This article was updated on 2026-08-21 to document the new vbsf-export 1.0.0-27, which introduces support for export to local storage in addition to the previous cloud-only destinations. Purpose This article covers vbsf-export, a standalone utility that exports Salesforce backup data from a Veeam...

CVE-2026-50147 Metabase: Arbitrary File Read via MySQL Connection Property Injection

Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a Metabase database connection can read arbitrary files from the Metabase server's filesystem by adding unsafe JDBC parameters t...

CVE-2026-50148 Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write

Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user with permission to add or edit a database connection can achieve remote code execution on the Metabase server by...

PYSEC-2026-352 H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL

H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution. Exploitation can occur when an attacker has access to post to the ImportSQLTable URI with a JSON document containing a connectionurl property with a...

JeeWMS 安全漏洞

JeeWMS is a JAVA-based warehouse management system developed by JeeWMS Corporation in China. There is a security vulnerability in JeeWMS. This vulnerability stems from incorrect operations with parameters such as dbType/dbDriver/dbUrl/dbUsername/dbPassword in the JimuReport test-connection Endpoi...

EUVD-2025-210000

Nozomi Networks Labs identified a CWE-23: Relative Path Traversal Zip Slip in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 that allows attackers with access to the TX Host to execute code on the RX Host when a MySQL connector is configured and file compression is enabled...

Malicious code in @antv/g-plugin-canvas-path-generator (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in @antv/async-hook (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...