CVE-2024-34102

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 우리는 테러 조직 하마스에 의해 인질로 잡힌 모든 시민의 안전한 귀환을 요구합니다. 모든 인질이 석방되어 안전하게 집으로 돌아올 때까지 우리는 쉬지 않을 것입니다. 여러분도 그들을 집으로 데려오는 데 도움을 줄 수 있습니다.https://stories.bringthemhomenow.net/ CVE-2024-34102 PoC 🚀 이 저장소는 Magento의 치명적인 XML 엔티티 주입 취약점CVE-2024-34102에 대한 개념 증명PoC 익스플로잇을 포함하고...

CVE-2026-7658 Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement

IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass containment checks. This enables multiple severe impacts, including arbitrary directory deletion, cross-tenant data destruction, and JWT signing ke...

Security Bulletin: Python Interpreter Sandbox Bypass Leading to Sensitive Data Exposure

Summary The Python Interpreter component and legacy Python REPL Tool component provided flow and agent authors the ability to execute Python code within a scoped globals environment restricted to an operator-configured import allow-list and curated safe builtins. An attacker who could provide inp...

CVE-2024-57432: Improper Authentication

macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. The application's JWT signing keys are hardcoded and do not change. User information is explicitly written into the JWT and used for subsequent privilege management, making it is possible to forge the JWT of any user to achieve...

Apache SeaTunnel Authentication Bypass Vulnerability

Apache SeaTunnel is the United States Apache Apache Foundation, an easy-to-use data integration framework. An authentication bypass vulnerability exists in Apache SeaTunnel version 1.0.0, which stems from the fact that jwt keys are hard-coded in the application and can be exploited by an attacker...

CVE-2023-22463 KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token

KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online project. Furthermor...