patch-CVE-2026-19843

パッチ: CVE-2026-19843 脆弱性の詳細 CVE : CVE-2026-19843 製品 : Cisco IOS XE 説明 : Web UI を介した権限昇格 深刻度 : 高 パッチの状態: デプロイ済み フィールド| 値 ---|--- パッチ適用日| 2026-06-15 ステータス| デプロイ済み デプロイ先| 本番環境 検証者| SecOps チーム 参考 NVD CISA KEV...

Microsoft Exchange - Authentication Bypass

Microsoft Exchange Server Information Disclosure Vulnerability. This vulnerability enables an attacker to bypass authentication and gain access to the Exchange Server's internal. id: CVE-2021-33766 info: name: Microsoft Exchange - Authentication Bypass author: daffainfo severity: high description...

PT-2026-107131

Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations...

Cisco ASA Uncontrolled Resource Consumption (CVE-2021-34792)

A vulnerability in the memory management of Cisco Adaptive Security Appliance ASA Software and Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper resource...

Security Advisory 0186

Security Advisory 0186 . CSAF PDF Date: October 6, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 6, 2026 | Initial release Description All CVEs covered in this advisory affect platforms running CloudVision Portal on-premises where OpenID Connect OIDC-based single sign-on SSO is...

PT-2026-107208

Remote code execution vulnerabilities exist in the affected interface of HPE Networking ClearPass Policy Manager that could allow an authenticated remote attacker with high privileges to execute arbitrary code. Successful exploitation could allow an attacker to execute arbitrary commands on the...

CVE-2025-51726

根据要求，我现在通过实际利用场景和PoC证据演示了这两个漏洞（BA2022和BA2015），展示了攻击者如何在真实环境中滥用这些问题。 📌 1. BA2022 代码签名中的弱哈希 – SHA-1 利用演示 虽然原始的 CyberGhostVPNSetup.exe 看起来已签名且受信任，但我已成功使用自签名证书和 SHA-1 哈希创建了一个伪造的安装程序（fakeCyberGhost.exe）。 ✅ 技术证明： 使用 OpenSSL 生成伪造的 CA 和 SHA-1 证书 使用 signtool.exe 用该证书签署伪造的二进制文件 Windows 仍将其标记为“已签名”（参见...

keycloak: Keycloak: Denial of Service via specially crafted SAML input

A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language SAML endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service DoS where the server becomes...

netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement

A flaw was found in Netty. Netty's DNS Domain Name System codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the...

CVE-2024-38063-

CVE-2024-38063- IPv6経由でカーネルをリモートから悪用する CVE-2024-38063 - IPv6経由でカーネルをリモートから悪用する マーカス・ハッチンス Marcus Hutchins...

Secure Your Mission-Critical Application Estate: Qualys TotalAppSec is Now FedRAMP High Authorized (FedRAMP Certified Class D)

Key Takeaways Qualys TotalAppSec is now FedRAMP High Authorized on the Qualys Government Platform FedRAMP Certified Class D, package FR2231052341. Federal AI use cases more than doubled in a year 3,611 use cases across 56 agencies, and most AI interactions are delivered through APIs; expanding an...

CVE-2026-50656

🚨 CVE-2026-50656 — Microsoft Defender "RoguePlanet" Microsoft マルウェア対策エンジンの特権昇格の脆弱性 ⚠️ 教育および防御的セキュリティ研究専用 📖 概要 CVE-2026-50656 は、Microsoft Defender が使用する Microsoft マルウェア対策エンジン に影響を与える高深刻度の 特権昇格 EoP 脆弱性です。 一般に RoguePlanet として知られるこの脆弱性は、不適切なリンク解決の問題 CWE-59 に起因し、低権限のローカル攻撃者が影響を受ける Windows...

CVE-2022-22978-demo

CVE-2022-22978-demo CVE-2022-22978漏洞示例代码 利用条件 虽然定为高危，但是利用条件还是比较苛刻的，个人感觉这个漏洞比较鸡肋。 1. 首先肯定是spring-security在漏洞影响范围内 2. 其次需要使用spring-security的正则匹配器regexMatchers或者直接使用RegexRequestMatcher，并且使用了. 匹配路径，类似这样： regexMatcher"/api/." // 允许/api下的所有子路径 regexMatcher"/files/.\.jpg" // 匹配所有.jpg结尾的文件请求...

CVE-2021-40859

CVE-2021-40859 Auerswald COMpact 8.0B バックドアエクスプロイト 概要 Auerswald COMpact 5500R 7.8A および 8.0B デバイスにおいて、Webベースの管理アプリケーションにアクセスできる攻撃者に対し、デバイスへの完全な管理者権限を許可するバックドアが発見されました。 製品詳細 製品: COMpact 3000 ISDN, COMpact 3000 analog, COMpact 3000 VoIP, COMpact 4000, COMpact 5000R, COMpact 5200R, COMpact 5500R,...

CVE-2021-44228-DFIR-Notes

CVE-2021-44228 DFIR-Notes 帰宅途中に、log4shell脆弱性に関する最初のメッセージが流れてきました。 Apache Log4j 2ユーティリティの複数のバージョンに影響する高重大度の脆弱性（CVE-2021-44228）が、2021年12月9日にプロジェクトのGitHubを通じて公開されました。この脆弱性は、Alibaba Cloud Security TeamのChen Zhaojun氏によって発見され、Apache Log4j 2のバージョン2.0から2.14.1に影響します。 帰宅後すぐに取り掛かりました。いつものようにSplunk4twです。...

Astra Linux – Vulnerability in Chromium

The use of “after free” in PDFium in Google Chrome before version 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption through a crafted PDF file. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The use of after-free in Media in Google Chrome before version 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Firefox

When parsing internationalized domain names, the high bits of the characters in the URLs were sometimes removed, resulting in inconsistencies that could cause confusion for users or lead to attacks like phishing. This vulnerability affects Firefox versions earlier than 94...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ARM: 9317/1: kexec: Make smp stop calls asynchronous If a panic is triggered by a hrtimer interrupt, all online CPUs will be notified and set to offline. However, as highlighted in the commit 19dbdcb8039c “smp: Warn on function...

Astra Linux – Vulnerability in Chromium

The inappropriate implementation of Autofill in Google Chrome prior to version 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to leak cross-origin data through a crafted HTML page. Chromium security severity: High...