CVE-2022-32114

Strapi v4.1.12 취약점 설명: Strapi v4.1.12의 새 자산 추가 기능에 제한 없는 파일 업로드 취약점이 존재하여, 공격자가 조작된 파일을 통해 임의 코드를 실행할 수 있습니다. 공격 벡터: 악성 콘텐츠를 포함한 파일을 업로드한 후, 사용자가 해당 파일의 링크를 열면 실행됩니다. 페이로드 : https://github.com/bypazs/GrimTheRipper/blob/main/GrimTheRipperTeam.pdf 테스트 환경: 1. Strapi 버전 4.1.12 2. Google Chrome 버전...

sandfly-entropyscan

What is sandfly-entropyscan? sandfly-entropyscan is a utility to quickly scan files or running processes and report on their entropy measure of randomness and if they are a Linux/Unix ELF type executable. Some malware for Linux is packed or encrypted and shows very high entropy. This tool can...

CVE-2020-25399

CVE-2020-25399 InterMind iMind Server 3.13.65 이하 버전에 저장형 XSS 취약점이 존재하여, 모든 사용자가 채팅에서 악성 파일을 전송하여 다른 사용자의 세션을 탈취할 수 있습니다. 정보 설명: 공격자는 채팅 기능을 사용하여 모든 사용자에게 악성 파일을 전송할 수 있습니다. 파일에는 JS 페이로드가 포함될 수 있으며, 파일이 열린 후 피해자의 브라우저에서 실행됩니다. 연구자: Andrey Skuratov https://github.com/h3llraiser/ 발행일: 2020-07-06 초기 ...

scan-cve-2018-8115

/\ / | | / \ | | | / /\ \ / | | | |/ | \ \ / / | | | | '| | | | | | / \ | | || | | | | / | || | | | | || || | // \, |,|,| |/ ||,|| |||, | | | / | || |/ Docker 이미지 검증 CLI 도구 CVE-2018-8115 커뮤니티의 안전을 돕기 위해 Aqua는 이미지가 이 취약점으로부터 안전한지 테스트하는 오픈 소스 도구를 만들었습니다. 이 유틸리티는 Docker Registry에 연결하여현재는...

AlmaLinux 9.2 [TuxCare] Security Update: LibRaw / LibRaw-devel / LibRaw-samples / LibRaw-static (ALMALINUX9.2:CLSA-2026:1783353880)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783353880 advisory. - A heap-based buffer overflow vulnerability exists in the x3fthumbloader functionality of LibRaw Commit d20315b. A specially crafted malicio...

Update your iPhone, iPad, or Mac: Flaw could run attackers’ code

Apple has released updates for iPhones, iPads, and Macs to fix a flaw that could let an attacker run code when a device processes a malicious file. Apple says it may have been used in highly targeted attacks against iPhone users running versions of iOS before iOS 27. The fix is in iOS and iPadOS...

ClearML-CVE-2024-24590-RCE

Clearml-CVE-2024-24590 CVE-2024-24590는 서버 측에서 부적절한 역직렬화가 발생할 때 악용될 수 있는 취약점입니다. 이 경우 Clearml에서 발생합니다. 공격자가 악의적인 Pickle 파일을 생성하면, 해당 Pickle 파일을 역직렬화하는 피해자에 대해 임의 코드를 실행할 수 있으며, 이는 원격 명령 실행을 위한 리버스 셸로 확대될 수 있습니다. clearml 라이브러리를 설치하는 것을 잊지 마세요. python -m venv .g source .g/bin/activate/ pip install...

CVE-2024-45427-Exploit

CVE-2024-45427 익스플로잇 생성기 이 스크립트는 PhpSpreadsheet 라이브러리v3.7.0의 CVE-2024-45427 을 익스플로잇하기 위한 악성 Excel.xlsx 파일을 생성합니다. 원시 XML을 조작하여 시트 이름에 XSS 페이로드를 주입하며, 표준 라이브러리 검증을 우회합니다. 사용 방법 1. exploit.py를 편집하고 MYIP와 PORT를 설정합니다. 2. 스크립트를 실행합니다: python3 exploit.py 3. 리스너를 시작합니다: python3 -m http.server 8000 4...

Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BIP...

Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

Foxit PDF Reader activeDocs Missing Authorization Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Foxit PDF Reader PRC Stream Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PR...

Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

CVE-2026-84396

InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in...

CVE-2026-83963

Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-81998

Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-83962

Substance3D - Modeler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-79906

Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-76192

InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in...