es_inject

CVE-2014-3120 Exécution de code à distance Elastic Search Ce projet démontre la vulnérabilité/mauvaise configuration CVE-2014-3120. Il vous permet de lire et d'ajouter du contenu à des fichiers sur le système hébergeant ES, à condition que l'utilisateur exécutant ES y ait accès. Notes Cela ne...

TIBCO JasperReports Library - Directory Traversal

The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for...

CVE-2026-92955

A flaw was found in vm2. This vulnerability allows an attacker running untrusted code within the sandbox to achieve arbitrary code execution on the host system. By accessing internal host properties through standard output streams, the untrusted code can manipulate process event handlers and esca...

CVE-2026-92946

A flaw was found in vm2. This vulnerability allows an attacker executing untrusted code within the sandbox to escape isolation and achieve arbitrary code execution on the host system. When external module loading is permitted without restricting access to dependency directories, sandboxed code ca...

CVE-2026-92944

A flaw was found in vm2. An attacker capable of running code within the sandbox environment can bypass security wrappers by supplying a crafted asynchronous Promise object. This flaw allows the attacker to escape the sandbox and access host system objects, leading to arbitrary code execution on t...

CVE-2026-92937

A flaw was found in vm2. This vulnerability allows an attacker to escape the sandbox environment and achieve arbitrary code execution on the host system. The issue occurs because the sandbox bridge fails to properly sanitize rejected Promise errors when handlers are registered through indirect...

CVE-2026-47698

A flaw was found in vm2. This vulnerability allows arbitrary code execution on the host system through a sandbox breakout. An attacker capable of running code inside the sandbox can manipulate host object properties using indirect function calls to bypass isolation boundaries and execute arbitrar...

DEBIAN-CVE-2026-97024

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files such as passwd, group, machine-id, or resolv.conf to be emptied or replaced with a symlink when the app is installed or upgraded...

CVE-2026-97024

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files such as passwd, group, machine-id, or resolv.conf to be emptied or replaced with a symlink when the app is installed or upgraded...

CVE-2026-97024

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files such as passwd, group, machine-id, or resolv.conf to be emptied or replaced with a symlink when the app is installed or upgraded...

CVE-2026-97024 Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files such as passwd, group, machine-id, or resolv.conf to be emptied or replaced with a symlink when the app is installed or upgraded...

EUVD-2026-88624

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files such as passwd, group, machine-id, or resolv.conf to be emptied or replaced with a symlink when the app is installed or upgraded...

CVE-2025-26056

CVE-2025-26056 작성자: Rohan Deshpande OS 명령어 주입 요약 OS 명령어 주입은 공격자가 취약한 애플리케이션을 통해 호스트 운영 체제에서 임의의 명령을 실행할 수 있게 하는 보안 취약점입니다. 이는 무단 액세스, 데이터 유출 및 시스템 손상으로 이어질 수 있습니다. 영향 OS 명령어 주입의 영향으로는 시스템 리소스에 대한 무단 액세스, 데이터 도난, 시스템 손상, 그리고 영향을 받는 서버에 대한 잠재적인 완전한 제어가 포함될 수 있으며, 이는 심각한 보안 침해와 운영 중단으로 이어질 수 있습니다. 영...

CVE-2026-18857: Out-of-bounds Read

IBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the BMC firmware management interface. The host system can cause the BMC firmware management service to crash or allow a limited amount of BMC internal memory to...

CVE-2026-93605: Protection Mechanism Failure

vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUSBUILTINS denylist omits childprocess despite blocking other host-spawning modules. Attackers can require childprocess and execute arbitrary commands on the host system when NodeVM is configured with...

MAL-2026-15833 Malicious code in apple-cktool-internal-api-v9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3faeeff2b18d0a2f9f9a5d8d9543b6d950f49c64f6313b37fc02bc68aa9fd9d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstackhr3ocw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f7f5462a6cad4608977cbf01ae1fab24a1257afe36d254ce404ca49b5aab99c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14852 Malicious code in 3layerdipstacko8li9w (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9886025a6437b781a80821d6f113c08dea138ee45899438c19bf9e7cf3e366c5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14808 Malicious code in 3layerdipstackkysrek (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20d1f569a2e645d005f3e8dd8f757dfa4b26f11d80dbea28773cf8528c0501af The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in svelte-streak-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b054f1d8e8f496e3bdabacf1bf5042b2aba5f9587646cbb874ae9e3ec9c7c7f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...