103 matches found
CVE-2024-38077-check
脆弱性分析の非同期PDFファイル。私の能力は限られており、まだRCEはできません。どうか先輩方のご指導をお願いします。 脆弱性の検証は、IPを変更するだけで済みます。 root@kitploit: if name == 'main': printlogo connecttolicenseserver"192.168.6.132"...
CVE-2026-89162
A flaw was found in PCRE2. The pcre2serializeencode function might disclose two bytes of information to an attacker. This vulnerability typically occurs in scenarios where the attacker already has unsafe access to the system, making exploitation difficult. The primary impact is a limited...
Oracle Linux 9 : mod_http2 (ELSA-2026-59387)
The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-59387 advisory. 2.0.26-6.2 - Resolves: RHEL-190583 - address CVE-2026-43951 and CVE-2026-48913 in modhttp2 Tenable has extracted the preceding description block...
CVE-2026-15576
Improper authentication in the agent receiver of Checkmk 2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and...
CVE-2026-6994
A flaw was found in Envoy. A remote attacker could exploit a weakness in the Query Parameter Handler component, specifically within the params.add function. This vulnerability allows for injection, which may lead to limited impacts on the confidentiality, integrity, and availability of the affect...
PT-2026-27476
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An unauthenticated attacker can exploit the 'validate' action in the Frontend to blindly instantiate arbitrary PHP classes. The impact of this issue depends on t...
CVE-2025-6894
An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in the API authorization logic of the affected device allows an authenticated, low-privileged user to execute the administrative ping function, which is restricted ...
EUVD-2018-2069
Malware in sbrugna...
EUVD-2024-22141
Malicious code in bioql PyPI...
EUVD-2025-13563
Malicious code in bioql PyPI...
EUVD-2023-39865
Malicious code in bioql PyPI...
EUVD-2025-7664
Malicious code in bioql PyPI...
EUVD-2025-16743
Malicious code in bioql PyPI...
CVE-2025-7039
A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to...
CVE-2024-44113
Due to missing authorization checks, SAP Business Warehouse BEx Analyzer allows an authenticated attacker to access information over the network which is otherwise restricted. On successful exploitation the attacker can enumerate information causing a limited impact on confidentiality of the...
CVE-2023-29110
The SAP Application Interface Message Dashboard - versions AIF 703, AIFX 702, S4CORE 100, 101, SAPBASIS 755, 756, SAPABA 75C, 75D, 75E, application allows the usage HTML tags. An authorized attacker can use some of the basic HTML codes such as heading, basic formatting and lists, then an attacker...
CVE-2023-35873
The Runtime Workbench RWB of SAP NetWeaver Process Integration - version SAPXITOOL 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration. The...
CVE-2023-35872
The Message Display Tool MDT of SAP NetWeaver Process Integration - version SAPXIAF 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration. The...
PT-2025-19900 · Wiesemann&Theis · Erp-Gateway 12X Digital Input +19
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A remote attacker with low privileges can execute arbitrary web scripts or HTML through a crafted payload injected into several fields of the configuration webpage, resulting in limited...
CVE-2025-25245 Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)
SAP BusinessObjects Business Intelligence Platform Web Intelligence contains a deprecated web application endpoint that is not properly secured. An attacker could take advantage of this by injecting a malicious url in the data returned to the user. On successful exploitation, there could be a...