CVE-2018-13257

انتحال رأس المضيف لتذكرة CAS في Blackboard Learn وحدة مصادقة داخل Blackboard Learn معرّضة لانتحال رأس مضيف HTTP أثناء التحقق من تذكرة الخدمة الخاصة بخدمة المصادقة المركزية CAS. تذكرة خدمة CAS مخصصة لـ خدمة محددة فقط، لكن Blackboard Learn لا يتحقق بشكل صحيح من أن هذه الخدمة هي المثيل الحالي. يتيح...

Stable Diffusion Webui 1.10.0 - Open Redirect

An open redirect vulnerability exists in Stable-Diffusion-Webui 1.10.0, where the file parameter in the /file= endpoint can be manipulated to redirect users to malicious websites. This could facilitate phishing attacks by tricking users into visiting attacker-controlled URLs. id: CVE-2024-11044...

Microsoft365_devicePhish

Microsoft365devicePhish استغلال تدفق تفويض OAuth في Microsoft 365 لهجمات التصيد هذا نص برمجي بسيط كإثبات للمفهوم يسمح للمهاجم بتنفيذ هجوم تصيد ضد تدفق تفويض OAuth في Microsoft 365. باستخدام هذا النص، يمكن الاتصال بنقاط نهاية واجهة OAuth من Microsoft لإنشاء usercode و devicecode والحصول على...

EUVD-2026-70328

Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Reliance on Data/Memory Layout vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to Launch of phishing attacks...

CVE-2019-12949

CVE-2019-12949 من ثغرة البرمجة النصية عبر المواقع إلى تنفيذ الأوامر عن بُعد في pfSense 2.4.4-p2 و 2.4.4-p3 وصف المعلومات: في pfSense 2.4.4-p2 و 2.4.4-p3، إذا كان من الممكن خداع المسؤول المصادق للنقر على زر في صفحة تصيّد، يمكن للمهاجم رفع كود برمجي تعسفي قابل للتنفيذ عبر dingcommand.php و...

SocialEngineering

SOCIAL ENGINEER 🎯🕵️ A powerful social engineering toolkit that automates phishing, OTP/email bombing, fake mail and more — built with ❤️ by @karthithehacker ⚠️ For educational use only. Do not use this tool against anyone without explicit permission. 📌 Возможности 🎯 Фишинговые атаки – имитация...

CVE-2026-80200 Kimai before 2.53.0 Open Redirect via RelayState

Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as redirect destinations. Attackers with IdP access can supply malicious RelayState values to redirect authenticated users to...

EUVD-2026-63130

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could bypass Search Processing Language SPL safeguards for risky commands through the Job Details dashboard. The injected SPL could run using the permissions of an...

EUVD-2026-63107

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, and 9.4.13, a user who does not hold the "admin" or "power" Splunk roles could trick another user into running arbitrary Search Processing Language SPL commands through the Data Model Editor using the permissions of the affected user. Th...

EUVD-2026-63104

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13, an unauthenticated user who tricks another user into visiting a malicious web page could run unauthorized JavaScript in that user's browser. This could allow for unauthorized access to all relevant data available to that user...

CVE-2026-76346

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious script in dashboard sparkline format options and execute unauthorized JavaScript in the browser of another user who views the dashboard. If the other user holds...

CVE-2026-76342

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store risky Search Processing Language SPL commands in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the commands when that user...

CVE-2026-76329

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick a user who holds the "admin" Splunk role into opening a crafted link to Monitoring Console. When that user opens the link, Splunk Enterprise runs attacker-controlled Search Processing...

CVE-2026-76323

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could bypass Search Processing Language SPL safeguards for risky commands through the Job Details dashboard. The injected SPL could run using the permissions of an...

CVE-2026-76320

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could cause an authenticated user to run arbitrary Search Processing Language SPL searches on their behalf through the Event Type Builder. This could expose all relevant data and stored credentials. Th...

CVE-2026-76342

A "power"-role Splunk user can embed risky SPL commands in a shared Table Editor dataset; when an admin opens it, the commands execute with admin privileges, bypassing SPL safeguards on the field-summary search and risking data exposure and lookup modification. Patch versions: 10.4.2, 10.2.6, 10....

CVE-2026-76339

In Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, the geostats command fails to validate input, allowing a low-privileged user to inject arbitrary SPL that executes under another user's permissions after phishing. CVSS 5.4 (MEDIUM); no exploitation evidence provided. Upgrade to affec...

CVE-2026-76323

CVE-2026-76323 is an SPL risky command safeguards bypass in the Job Details dashboard of Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . The root cause is that the dashboard does not correctly neutralize a caller-supplied search identifier before embedding it into SPL search...

CVE-2026-76322

CVE-2026-76322 is an SPL injection vulnerability in Splunk Enterprise (versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 ) affecting the Dashboard Studio component. A user holding the "user" role can craft a dashboard that executes attacker-controlled Search Processing Language (SPL) in the conte...

CVE-2026-76254

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14 are affected. Dataset Explorer fails to validate or escape dataset names when building SPL searches and skips SPL safeguards for risky commands, enabling a phishing attack to execute arbitrary SPL under the victim's privi...