87073 matches found
CVE-2026-107219
The Excelize Go language library (versions 2.3.1 to 2.11.0 ) is vulnerable to an uncontrolled resource consumption flaw (CWE-400) during the OpenFile operation. The agileDecrypt function accepts an attacker-controlled spinCount from a crafted OLE encrypted-workbook header and passes it to convert...
CVE-2026-36438
CVE-2026-36438: パスワードリセットを介した機密情報 Intelbras VIP 1230 B/D G4 のバージョン6未満では、リモートの攻撃者がOutsideCmdファイル下のパスワードリセット機能を介して管理者アカウントの機密情報を取得できます。 Henrique Koji により発見, 2026年2月。 参照: https://backend.intelbras.com/sites/default/files/2026-03/Changelog%20%E2%80%93%20VIP%201230%20B-D%20G4.pdf...
CMS-Made-Simple-2.2.9-CVE-2019-9053
면책 조항 이 저장소는 CMS Made Simple 버전 2.2.9 및 이전 버전에서 인증되지 않은 SQL 인젝션 취약점을 대상으로 하는 Python 3 호환 익스플로잇을 제공합니다. CVE-2019-9053으로 추적되는 이 결함은 공격자가 사용자 이름, 해시된 비밀번호, 이메일 및 솔트를 포함한 민감한 관리자 데이터를 추출할 수 있도록 합니다. 원본 익스플로잇은 Daniele Scanu가 작성했습니다. Original Exploit : https://www.exploit-db.com/exploits/46635 이 스크립트를...
CVE-2026-20328
A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application. This vulnerability is due to improper checks during th...
EUVD-2026-94455
Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an admin account with the password sipcapture stored as a legacy SHA-256 hex hash. There is no first-login...
CVE-2026-62252 Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login
Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an admin account with the password sipcapture stored as a legacy SHA-256 hex hash. There is no first-login...
CVE-2026-62252
Homer , an open-source telecom observability software, contains a hardcoded default admin password vulnerability in versions prior to 11.0.283 . The bootstrap process automatically creates an admin account with the password sipcapture (stored as a legacy SHA-256 hex hash) when using internal auth...
CVE-2026-62252 Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login
Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an admin account with the password sipcapture stored as a legacy SHA-256 hex hash. There is no first-login...
CVE-2026-62252 Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login
Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an admin account with the password sipcapture stored as a legacy SHA-256 hex hash. There is no first-login...
CVE-2026-20328
A vulnerability in the web-based management interface of Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem ) allows an unauthenticated, remote attacker to gain unauthorized access. The root cause is improper checks during the password reset process. By sending a malicious reque...
EUVD-2026-94448
A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application. This vulnerability is due to improper checks during th...
CVE-2026-20328 Cisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability
A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application. This vulnerability is due to improper checks during th...
CVE-2026-20328 Cisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability
A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application. This vulnerability is due to improper checks during th...
CVE-2012-2122-Home-Lab
CVE-2012-2122 MySQL 認証バイパス ホームラボ このラボは、CVE-2012-2122 - MySQL 認証バイパス の脆弱性をデモンストレーションするものです。 MySQL 5.5.23 以前のバージョンにおけるパスワード比較のエラーが原因で発生します。 攻撃者が間違ったパスワードを繰り返し送信すると、MySQL が誤ってログインを許可してしまう可能性があります。 特徴 vulhub/mysql:5.5.23 をベースに使用 entrypoint.sh スクリプトでフラグを自動生成 フラグは /tmp/flag.txt に配置 docker restart...
EUVD-2026-94402
Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can send a different forwarded address per request so the limiter keyed on rewritten RemoteAddr never...
CVE-2026-107271 Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing
Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can send a different forwarded address per request so the limiter keyed on rewritten RemoteAddr never...
CVE-2026-107271 Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing
Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can send a different forwarded address per request so the limiter keyed on rewritten RemoteAddr never...
CVE-2026-107276 MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests
MISP contains a race condition in the email-based one-time password OTP login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store,...
CVE-2025-63314
CVE-2025-63314 - Acora CMS におけるパスワードリセットトークン処理の不備 Crowe India の Joby Y Daniel によって発見されました 📌 概要 DDSN Interactive cm3 Acora CMS バージョン 10.7.1 には、パスワードリセット機能にセキュリティ上の脆弱性が存在します。 このアプリケーションは、使用後に無効化されず、時間の経過によっても失効しない、静的かつ永続的なパスワードリセットトークンを使用します。 この欠陥により、有効なリセットトークンを入手した攻撃者は、そのトークンを無期限に再利用でき、特権ユーザーアカウン...
FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials
The U.S. Federal Bureau of Investigation FBI and Secret Service USSS on Tuesday warned that the FortiBleed credential harvesting campaign remains an active threat aimed at internet-facing Fortinet FortiGate firewalls and secure socket layer SSL virtual private network VPN gateways. "The campaign...