CVE-2019-14811-in-pdf-exploit

CVE-2019-14811 GhostScript PDFプレビュー Exploit PoC このエクスプロイトは、PostScript出力が反映されず、png画像を介したPDFプレビューなどで実行されるGS環境におけるCVE-2019-14811を標的としています。 エクスプロイトはpngXXmプレビューで直接コマンドを描画します。これは https://github.com/hhc0null/GhostRule/blob/master/ghostrule1.ps に基づいています。...

CVE-2019-3396

CVE-2019-3396 Confluence Widget Connector のパストラバーサル CVE-2019-3396 RCE POC POST /rest/tinymce/1/macro/preview HTTP/1.1 Host: x.x.x.x Connection: close Accept-Encoding: gzip, deflate Accept: / User-Agent: Mozilla/5.0 X11; Linux x8664; rv:60.0 Gecko/20100101 Firefox/60.0 Content-Type:...

defcon_27_windbg_workshop

“使用 WinDbg Preview 进行现代调试” DEFCON 27 工作坊 此仓库包含 DEFCON 27 工作坊 的资料 概述 摘要 现在是 2019 年，然而仍有太多 Windows 开发者和黑客依赖于（有用但相当）老式的工具来调试 Windows 二进制文件（OllyDbg、Immunity Debugger）。他们没有意识到的是，他们错过了微软最新的 WinDbg Preview 版本所带来的宝贵工具和功能。这个动手实践的工作坊将尝试拉平差距，通过实际演示 WinDbg 已经改变到了何种程度——它应当成为任何用于二进制分析的 Windows 10...

CVE-2026-79294

CVE-2026-79294 CVE-2026-79294 — Stored XSS in Moonshot AI Kimi's HTML artifact Preview, delivered through the public Share view, leading to session token exfiltration and demonstrated account takeover. Responsible disclosure advisory. Vulnerability Details Vulnerability Type: Stored/Stored-like...

cve-2025-24071

CVE-2025-24054 和 CVE-2025-24071 - 通过 .library-ms 漏洞泄露 NTLM 哈希 该 PoC 演示了在未修补的 Windows 系统（2025 年 3 月补丁星期二）上通过 .library-ms 文件利用 NTLM 哈希泄露。 ⚠️ 本内容仅供教育和研究目的使用。请勿在生产环境或未经授权的系统上使用。 🧠 描述 当在 Windows 资源管理器中打开（或预览）包含 UNC 路径的 .library-ms 文件时，会触发向指定服务器发送 SMB 认证请求，导致 NTLMv2 哈希泄露。 📁 文件 generatelibraryms.py：生成恶意的...

CVE-2026-104907

MISP contains a cross-site scripting XSS vulnerability in the remote event preview page. When a linked remote MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript...

CVE-2026-104900

MISP contains a stored cross-site scripting XSS vulnerability in the index table rendering of the remote event preview. The count field template escaped the associated link URL but rendered the field value without HTML encoding. An attacker with the ability to create or modify events on a linked...

EUVD-2026-91743

MISP contains a cross-site scripting XSS vulnerability in the remote event preview page. When a linked remote MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript...

CVE-2026-104907 MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler

MISP contains a cross-site scripting XSS vulnerability in the remote event preview page. When a linked remote MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript...

CVE-2026-104907

MISP is vulnerable to a cross-site scripting (XSS) flaw in the remote event preview page. The issue arises because tag identifiers are rendered within an inline JavaScript onclick attribute; while these values are HTML-escaped, they are not properly sanitized for a JavaScript string context. A ma...

CVE-2026-104907 MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler

MISP contains a cross-site scripting XSS vulnerability in the remote event preview page. When a linked remote MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript...

CVE-2026-104900 MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index

MISP contains a stored cross-site scripting XSS vulnerability in the index table rendering of the remote event preview. The count field template escaped the associated link URL but rendered the field value without HTML encoding. An attacker with the ability to create or modify events on a linked...

CVE-2026-104900 MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index

MISP contains a stored cross-site scripting XSS vulnerability in the index table rendering of the remote event preview. The count field template escaped the associated link URL but rendered the field value without HTML encoding. An attacker with the ability to create or modify events on a linked...

EUVD-2026-91669

MISP contains a stored cross-site scripting XSS vulnerability in the index table rendering of the remote event preview. The count field template escaped the associated link URL but rendered the field value without HTML encoding. An attacker with the ability to create or modify events on a linked...

CVE-2026-104900

MISP is affected by a stored cross-site scripting (XSS) vulnerability in the remote event preview index table rendering. The issue stems from the count field template failing to apply HTML encoding to the field value, even though it escapes the associated link URL. An attacker capable of creating...

CVE-2026-104471

YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field references a remote .php URL, which is saved...

CVE-2026-104454

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an On^2 markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool...

CVE-2026-104410

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document embedding a database view to obtain...

CVE-2026-104471

Versions of YesWiki before 4.6.7 are vulnerable to an unrestricted file upload vulnerability. Authenticated administrators can exploit this by using the Bazar CSV import preview to write remote files into the web-accessible files/ directory. The root cause is a lack of extension checks when a CSV...

EUVD-2026-91482

YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field references a remote .php URL, which is saved...