256 matches found
CVE-2024-3094_xz_check
CVE-2024-3094 xz 확인 스크립트 이 저장소에는 시스템이 CVE-2024-3094에 명시된 대로 취약한 버전의 "xz" 유틸리티를 실행 중인지 확인하는 Bash 스크립트와 한 줄 명령이 포함되어 있습니다. 아래는 RedHat https://access.redhat.com/security/cve/CVE-2024-3094 를 통해 제공되는 정보의 설명 및 영향 설명입니다: "5.6.0 버전부터 "xz"의 업스트림 타르볼에서 악성 코드가 식별되었습니다. 이 코드는 liblzma의 빌드 프로세스가 소스 코드 내의 위장된 테...
CVE-2022-45472
CVE-2022-45472 DOM Based XSS 소프트웨어: CAE Learning Space Enterprise with Intuity License 이미지 버전: 267r 패치 레벨: 639 취약점: DOM Based XSS 설명 CAE Learning Space Enterprise 관리 소프트웨어는 DOM Based XSS 공격에 취약합니다. DOM Based XSS 공격은 사용자가 실행된 페이로드를 호스트에 전송하고, 그 결과 원래의 클라이언트 측 스크립트에서 피해자 브라우저의 DOM 환경을 수정하는 것입니다. 이...
Microsoft-Office-Word-MSHTML-Remote-Code-Execution-Exploit
Microsoft-Office-Word-MSHTML-Remote-Code-Execution-Exploit CVE-2021-40444 메타스플로잇에서 사용할 익스플로잇입니다. 공격자가 파일에 악성 코드를 주입하여 Microsoft Office Word를 통해 원격 코드 실행을 얻을 수 있습니다...
CVE-2024-3094-info
CVE-2024-3094-정보 https://github.com/lockness-Ko/xz-vulnerable-honeypot https://tukaani.org/xz-backdoor/ - Lasse Collin 응답 https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27...
Malicious code in thurdweb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 775ff15f4a1314978d4cfed1e97c6c9ac8621d8ddeed93160c25aa3681f73cc7 Package name thurdweb is a one-character substitution of the popular web3 SDK thirdweb, but the shipped source is a copy of MikeMcl/big.js...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the RichEditor field when it is disabled, as its state is rendered without sanitizing HTML content. An attacker can execute arbitrary HTML or JavaScript in the context of users viewing the form by injecting...
Keras 路径遍历漏洞
Keras is an open-source deep learning framework developed by Keras. Versions of Keras prior to 3.14.0 contained a path traversal vulnerability. This vulnerability stemmed from a path traversal issue in the archive extraction tool. The functions filtersafetarinfos and filtersafezipinfos used to...
CVE-2026-34926: Relative Path Traversal
A directory traversal vulnerability in the Apex One on-premise server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploitable on the on-premise version of Apex...
Attackers adopt JavaScript runtime Bun to spread NWHStealer
In our previous research, we analyzed a Windows infostealer we track as NWHStealer. The attackers behind this stealer are continuously finding new methods to distribute the stealer. During our hunting activities, we noticed how attackers are using a JavaScript runtime called Bun to help distribut...
EUVD-2019-20087
Ask Expert Script 3.0.5 contains cross-site scripting and SQL injection vulnerabilities that allow unauthenticated attackers to inject malicious code by manipulating URL parameters. Attackers can inject script tags through the cateid parameter in categorysearch.php or SQL code through the view...
PT-2026-28466
Name of the Vulnerable Software and Affected Versions Home Assistant versions 2020.02 through 2026.01 Description Home Assistant, an open-source home automation software, contains a flaw where an authenticated user can inject malicious code into a device entity name. This allows for Cross-Site...
CVE-2026-20116 Multiple Cisco Contact Center Products Cross-Site Scripting Vulnerabilities
A vulnerability in the web-based management interface of Cisco Finesse, Cisco Packaged Contact Center Enterprise Packaged CCE, Cisco Unified Contact Center Enterprise Unified CCE, Cisco Unified Contact Center Express Unified CCX, and Cisco Unified Intelligence Center could allow an unauthenticate...
EUVD-2020-30957
Outline Service 1.3.3 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path in C:\Program Files x86\Outline to inject malicious code that would execute with...
CVE-2021-47770: Improper Control of Generation of Code
OpenPLC v3 contains an authenticated remote code execution vulnerability that allows attackers with valid credentials to inject malicious code through the hardware configuration interface. Attackers can upload a custom hardware layer with embedded reverse shell code that establishes a network...
CVE-2022-38625
Patlite NH-FB v1.46 and below was discovered to contain insufficient firmware validation during the upgrade firmware file upload process. This vulnerability allows authenticated attackers to create and upload their own custom-built firmware and inject malicious code. NOTE: the vendor's position i...
CVE-2022-26947
Archer 6.x through 6.9 SP3 6.9.3.0 contains a reflected XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the...
CVE-2021-27602
SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain modules within the application. An attacker with this authorization can inject malicious code in the...
EUVD-2000-0876
Malware in sbrugna...