Breaking the Bounded Entanglement Barrier for Quantum Position Verification

Position verification, introduced by Chandran et al. SIAM J. Computing 2014, allows verifiers to test a prover's claimed position by an interactive protocol. Classical position verification is impossible. Even for Quantum Position Verification QPV, there always exists an LOCC Local Operations and...

Clematis

Clematis 中文 | English 🛠️ 一个强大的工具，用于将PE文件（EXE/DLL）转换为与位置无关的shellcode。 ✨ 主要特性 支持将PE文件（EXE/DLL）转换为shellcode 同时兼容x86和x64架构 支持命令行参数 内置LZNT1压缩算法，显著减小输出文件大小 可选的混淆功能，增强隐蔽性 📦 安装 依赖项 pip install pefile lznt1 🚀 使用方法 python clematis.py -f -o -g -c -p 参数说明 | | 描述| 默认值| 是否必需 ---|---|---|---|--- -f| --file|...

venom-rs

使用 Rust 实现的 Shellcode 反射式 DLL 注入 sRDI（代号：Venom） Shellcode 反射式 DLL 注入（sRDI）是一种进程注入技术，它允许我们将给定的 DLL 转换为位置无关代码，然后可以使用我们最喜欢的 Shellcode 注入与执行技术来注入该代码。 特性 反射式加载器的大小约为 4KB。 不会释放注入器分配的内存，也不会移除用户注入器设置的任何现有 RWX 权限（如果适用）。 不会在解析导入或重定位映像之后/之前覆盖或擦除新分配内存的 DOS 或 NT 头。 对由 VirtualAlloc 函数分配的每个节应用保护设置，并随后执行 DllMain...

CVE-2024-34221

PHPとMySQLを使用した人事管理システムプロジェクト フリーソースコード 提出者: Kha Do 脆弱性 安全でない権限 説明 SourceCodester Human Resource Management System 1.0の/hrm/controller/ccity.php?positionedit=に安全でない権限の脆弱性が存在し、攻撃者が一般ユーザーには許可されていない機能にアクセスできる可能性があります。 影響を受けるコンポーネント パスURL: /hrm/controller/ccity.php?positionedit= パラメータ: position.php 影響...

Lastenzug

LastenZug 该项目实现了一个基于 websockets 的 Socks4a 代理。 客户端组件使用 C 语言实现，并编译为完全位置无关的代码（PIC）。 在编译过程中，通过利用位于 LastenPIC/SpiderPIC 的第二个工具 SpiderPIC ，在汇编层面应用混淆。 SpiderPIC 混淆包括： 指令替换 添加垃圾代码以及跳转越过垃圾代码 添加无用的指令 这旨在破坏静态签名，但你需要记住，API 哈希、字符串和其他常量在此过程中不会被混淆。 使用方法 客户端 makefile 同时生成 PIC socks 客户端和一个用于 shellcode 的示例加载器。...

CVE-2026-67236

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...

DEBIAN-CVE-2026-67236

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...

CVE-2026-67236 RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...

PT-2026-97544

Name of the Vulnerable Software and Affected Versions automation-controller affected versions not specified Description A flaw exists in the install-bundle endpoint. When a System Administrator downloads an install bundle for an execution or hop node, the controller signs an X.509 certificate usi...

CVE-2026-88993

The All Bootstrap Blocks WordPress plugin, affecting versions up to and including 1.3.31 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The issue arises because the plugin fails to properly escape a block attribute before outputting it into an HTML tag-name position . This allows us...

CVE-2026-91984

Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

CVE-2026-91984 Vikunja before 2.6.0 Broken Object-Level Authorization via task-position

Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

CVE-2026-91984

Vikunja before 2.6.0 suffers from a Broken Object-Level Authorization in its task-position endpoints. The application fails to validate that a user-supplied project_view_id belongs to the task's own project, allowing authenticated attackers to insert task position rows into arbitrary other tenant...

CVE-2026-91984 Vikunja before 2.6.0 Broken Object-Level Authorization via task-position

Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

EUVD-2026-78655

Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

CVE-2026-91984 Vikunja before 2.6.0 Broken Object-Level Authorization via task-position

Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

CVE-2026-91984: Authorization Bypass Through User-Controlled Key

Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

PT-2026-91876

The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'position button' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

PT-2026-92098

Vikunja before 2.6.0 fails to validate that user-supplied project view id in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

CVE-2026-86889

A certificate validation issue was addressed with improved certificate validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker in a privileged network position may be able to intercept network traffic...