Lucene search
+L

3443 matches found

Kitploit
Kitploit
added 2026/08/25 4:13 a.m.158 views

libinjection

libinjection SQL / SQLI tokenizer parser analyzer. For C and C++ PHP Python Lua Java external port LuaJIT/FFI https://github.com/p0pr0ck5/lua-ffi-libinjection external port See https://www.client9.com/ for details and presentations. Simple example: root@kitploit: include include include include...

7.5AI score
SaveExploits0References5
NVD
NVD
added 2026/08/22 1:16 p.m.9 views

CVE-2026-62381

luci-lib-px5g LuCI contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1addobj x509write.c when signing a certificate with a 2040-bit RSA key. For a 255-byte signature, the BIT STRING allocation is computed from the DER length encoding of 255 bytes, but the payload writt...

6.9CVSS0.00076EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/22 12:26 p.m.9 views

EUVD-2026-64273

luci-lib-px5g LuCI contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1addobj x509write.c when signing a certificate with a 2040-bit RSA key. For a 255-byte signature, the BIT STRING allocation is computed from the DER length encoding of 255 bytes, but the payload writt...

6.9CVSS5.8AI score0.00076EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/18 7:06 p.m.19 views

CVE-2026-19670 Incorrect Authorization in CISA Malcolm

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

5.4CVSS0.00185EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/18 7:06 p.m.51 views

CVE-2026-19670

Malcolm's nginx Lua RBAC layer pattern-matches the raw percent-encoded URI while nginx routes using the decoded URI, allowing an authenticated low-privilege user to access admin-only paths via encoded URLs like /%68tadmin.php. CVSS 5.4 (MEDIUM); no in-the-wild exploitation reported. No patch vers...

5.4CVSS5.3AI score0.00185EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/18 7:06 p.m.9 views

EUVD-2026-61157

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

5.4CVSS5.4AI score0.00185EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/18 7:06 p.m.32 views

CVE-2026-19670 Incorrect Authorization in CISA Malcolm

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

5.3CVSS5.5AI score0.00326EPSS
SaveExploits0References4
Tenable Nessus
Tenable Nessus
added 2026/08/17 12:00 a.m.5 views

Unity Linux 20.1050e / 20.1070e Security Update: lua (UTSA-2025-000295)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-000295 advisory. ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal3,2^31. Tenable has extracted the...

5.3CVSS6.4AI score0.03833EPSS
SaveExploits1References3
Cvelist
Cvelist
added 2026/08/11 8:30 p.m.29 views

CVE-2026-63177 Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized ngx.var.requesturi, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can...

7.1CVSS0.00189EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/11 8:30 p.m.19 views

CVE-2026-63177 Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized ngx.var.requesturi, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can...

7.1CVSS5.3AI score
SaveExploits0References4
CVE
CVE
added 2026/08/11 8:30 p.m.59 views

CVE-2026-63177

What is affected: Malcolm (network traffic analysis tool suite). The issue is in the Nginx OpenResty Lua RBAC layer prior to v26.07.0, where RBAC evaluates the unnormalized ngx.var.request_uri while Nginx routes on the normalized path. Root cause: URI normalization mismatch allows a low-privilege...

7.1CVSS5.3AI score0.00189EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/08/11 8:30 p.m.6 views

CVE-2026-63177

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized ngx.var.requesturi, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can...

7.1CVSS5.3AI score0.00189EPSS
SaveExploits0References3Affected Software1
EUVD
EUVD
added 2026/08/11 8:30 p.m.10 views

EUVD-2026-56972

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized ngx.var.requesturi, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can...

7.1CVSS5.3AI score0.00189EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/08/11 8:30 p.m.7 views

CVE-2026-63177 Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized ngx.var.requesturi, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can...

7.1CVSS5.3AI score0.00189EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/11 5:03 p.m.40 views

CVE-2026-50472 Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability

...

7CVSS0.00246EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/08/11 5:03 p.m.7 views

CVE-2026-50472 Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability

...

7CVSS5.2AI score0.00246EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/11 5:03 p.m.95 views

CVE-2026-50472

The CVE-2026-50472 entry refers to a heap-based buffer overflow in Windows LUA File Virtualization Filter Driver (LUAFV) that allows an authorized, local attacker to achieve privilege escalation. Affected software is Windows LUAFV; the underlying issue is a heap-based overflow, leading to local p...

7CVSS5.4AI score0.00246EPSS
SaveExploits0References1Affected Software13
NVD
NVD
added 2026/08/05 11:16 a.m.9 views

CVE-2026-71235

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine re/lua.go performs no input validation at all and preloads dangerous libraries: db arbitrary database access, ioutil file I/O, ...

8.8CVSS0.00288EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/08/05 10:56 a.m.10 views

CVE-2026-71235 Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine re/lua.go performs no input validation at all and preloads dangerous libraries: db arbitrary database access, ioutil file I/O, ...

8.8CVSS5.2AI score0.00288EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/05 10:56 a.m.42 views

CVE-2026-71235 Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine re/lua.go performs no input validation at all and preloads dangerous libraries: db arbitrary database access, ioutil file I/O, ...

8.8CVSS0.00288EPSS
SaveExploits0References1
Rows per page
Query Builder