januscape

Januscape — Linux KVM/x86 ゲストからホストへのエスケープ追跡サイト Januscape パッチステータストラッカーのソース: Linux カーネルにおける KVM/x86 のゲストからホストへのエスケープに対する修正を、どのディストリビューションがリリースしたかを記録する単一ページのサイトです。 正確な情報の所在 このバグに関するすべて — CVE ID、影響を受けるバージョンと修正済みバージョン、上流の修正コミット、発見・開示のクレジット、および現時点のディストリビューション別パッチステータス — は、この README ではなくトラッカーページに属します:...

hawk

Hawk Hawkは、私が同じスイートでさまざまな種類のタスクを実行できるように開発したネットワークおよびペンテスト用ユーティリティです。ツールを次々と切り替える必要はありません。 現在、このスクリプトは、ifconfig 、ping 、traceroute 、ポートスキャン （SYN、TCP、UDP、ACK、包括的スキャンを含む）、ホスト検出 （ローカルネットワーク上の起動中のデバイスをスキャン）、MACアドレス検出 （ローカルネットワーク上のホストIPのMACアドレスを取得）、バナー取得 、DNSチェック （地理位置情報付き）、WHOIS 、サブドメイン列挙 、脆弱性偵察...

EUVD-2026-90902

Stack-based buffer overflow in modvhostalias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when...

CVE-2026-63292 Apache HTTP Server: mod_vhost_alias stack overflow

Stack-based buffer overflow in modvhostalias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when...

CVE-2026-63292

A stack-based buffer overflow exists in mod_vhost_alias within the Apache Software Foundation Apache HTTP Server (versions through 2.4.68). An attacker can trigger this by sending an HTTP request with a Host header exceeding 8192 bytes, provided that VirtualDocumentRoot uses a hostname format spe...

CVE-2011-1473-POC

CVE-2011-1473-POC CVE-2011-1473 POC 脚本 用法 python3 poc-CVE-2011-1473.py --target TARGETHOST --count 5 --debug...

vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks

Summary vm2 current head v3.11.5, commit 7a1f5100b96f48d34e0fe104ab37c0acc5944f92 still exposes registered Node.js internal symbols from host WebStream prototypes to sandbox code. The prior nodejs. symbol hardening blocks Symbol.for'nodejs.' at the source, but the extraction filters and bridge...

vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts

Summary The vm2 command-line tool installed by npm install -g vm2 and documented in the README's "CLI" section runs the supplied script under NodeVM with require:external:true and no root / context / builtin configured. With these defaults the resolver loads every relative or absolute require...

NPM: vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts

host-realm require is reachable from sandboxed scripts vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.6...

vm2 exposes host HTTPS credentials and TLS traffic through globalAgent

Summary vm2 3.11.6 exposes the host process's real https.globalAgent when a NodeVM is explicitly allowed to require https. The module is wrapped as read-only, but calls to methods on the shared agent still mutate the host object. Sandbox code can register a free listener and receive host request...

vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

Summary vm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It can restrict access to built-in modules and external packages. When NodeVM enables an external allowlist together with a custom resolve callback, vm2 checks the requested package na...

NPM: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

NPM: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.6...

EUVD-2026-81600

vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package...

GHSA-C48M-32M9-VX93 vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

Summary vm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It can restrict access to built-in modules and external packages. When NodeVM enables an external allowlist together with a custom resolve callback, vm2 checks the requested package na...

GHSA-6RH5-QQ4Q-97XH vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

Summary NodeVM's builtin wildcard policy can allow sandboxed code to access fs/promises even when the embedder denies fs. With the following configuration: js require: builtin: '', '-fs', '-childprocess' require'fs' and require'childprocess' are blocked, but require'fs/promises' and...

vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE

Summary The NodeVM constructor computes hasRealRequireConfig using typeof requireOpts === 'object' && requireOpts !== null, so require: bypasses the guard intended to reject nesting without an explicit require configuration. makeResolverFromLegacyOptions then destructures the array to undefined...

vm2 crypto builtin loads attacker native code through setEngine

Summary vm2 3.11.6 exposes the host crypto module to a NodeVM when that single builtin is allowed. The module is presented through a read-only bridge, but its functions still execute with host-process authority. crypto.setEngine accepts a filesystem path and asks OpenSSL to dynamically load the...

NPM: vm2 NodeVM can replace the host process TLS trust store

NPM: vm2 NodeVM can replace the host process TLS trust store vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.3, = 3.11.6...

CVE-2024-21626-PoC

CVE-2024-21626 根本原因 & 概念実証コード poc-autoplay の使い方は？ make install make uninstall 1. 根本原因 runc v1.1.11 以下のバージョンでは、cgroup を設定するためにホストの /sys/fs/cgroup ディレクトリを開く過程で、そのファイルディスクリプタをコンテナ初期化プロセスで閉じずに残したままにしたため、この脆弱性が発生する。 1. runc init 段階でホストの /sys/fs/cgroup を介して /proc/PID/fd/7 を取得。 2. その fd を閉じないままコンテナの PID...

foreman: Excessive Permissions for Viewer Role on Preview

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root...