134778 matches found
libreoffice-remote-arbitrary-file-disclosure
Descripción de la vulnerabilidad CVE-2018-6871 Primera parte LibreOffice es compatible con la función COM.MICROSOFT.WEBSERVICE: https://support.office.com/en-us/article/webservice-function-0546a35a-ecc6-4739-aed7-c0b7ce1562c4 La función es necesaria para obtener datos por URL, normalmente se usa...
obike
Descripción del Protocolo oBike BLE/HTTP Este documento proporciona un análisis de los protocolos de comunicación de oBike a partir de enero de 2018. Los resultados se han presentado en insomni'hack security conference 2019: diapositivas grabación así como en AREA41 security conference 2018:...
POC-CVE-2025-55182
CVE-2025-55182 - React RSC RCE PoC para la vulnerabilidad de deserialización en el protocolo Flight de React Server Components. ¿Qué es? Next.js 14+ y React 19 usan un protocolo propietario "Flight" para comunicarse entre cliente y servidor. El problema: el servidor carga cualquier módulo sin...
CVE-2026-94485
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...
CVE-2026-94486
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...
CVE-2026-94485
The Next.js framework (versions 16.0.0 through 16.3.8 ) contains a vulnerability in the next dev development server. The server exposes a Model Context Protocol (MCP) endpoint that lacks reliable restrictions on cross-site requests . If a developer visits a malicious website while the development...
EUVD-2026-91673
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...
EUVD-2026-91667
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...
CVE-2026-94486 Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...
CVE-2026-94486
The Next.js React framework contains a vulnerability in the next dev development server, specifically affecting versions 16.0.0 through 16.3.8 . The server exposes a Model Context Protocol (MCP) endpoint that fails to reliably restrict cross-site requests. This flaw allows an attacker to issue un...
CVE-2026-94486 Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...
CVE-2026-94486 Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...
freerdp: FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass
A flaw was found in FreeRDP server. This vulnerability allows unauthenticated attackers to bypass server policies that disable Remote Desktop Services over Transport Layer Security RDSTLS connections. By sending incompatible protocol requests and then completing a TLS handshake, attackers can...
Critical: Red Hat Security Advisory: freerdp security update
An update for freerdp is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
DEBIAN-CVE-2026-66858
The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...
CVE-2026-66858
Apache Thrift versions before 0.25.0 are vulnerable to a Denial of Service (DoS) attack due to a flaw in the protocol skip routine. Specifically, multiple language bindings fail to enforce recursion limits when processing skipped fields in incoming messages. A remote, unauthenticated attacker can...
CVE-2026-66858
The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...
pocs_slides
Comparto mis advisories, PoCs, diapositivas y scripts sobre seguridad en IoT / protocolos. Puedes encontrarme en: Medium: https://medium.com/@cq674350529 Blog: https://cq674350529.github.io/ Mail: [email protected] Twitter: @cq674350529 Diapositivas OffByOne2025: Patch Diffing, ¡eres mi...
Atlas
Atlas Atlas is a cross-platform Windows/Linux network execution and security assessment toolkit built on top of TrustedSec's Titanis protocol library. It is inspired by the workflow of NetExec/CrackMapExec: target lists, credential sets, modular enumeration, and compact HH:mm:ss + host - message...
acp-framework-en
ACP — Agent Control Protocol Admission control for agent actions. Before any agent mutates system state, ACP answers four questions: Who is this agent? What are they authorized to do? Is this action policy-compliant? Can the outcome be traced to an accountable institution? Cryptographic identity ...