CVE-2019-6340

CVE-2019-6340 Drupal8의 REST RCE, SA-CORE-2019-003 0x01 docker search CVE-2019-6340 NAME DESCRIPTION STARS OFFICIAL AUTOMATED knqyf263/cve-2019-6340 Environment for CVE-2019-6340 Drupal 0 cved/cve-2019-6340 cve-2019-6340 0 0x02 docker pull knqyf263/cve-2019-6340 Using default tag: latest latest:...

CVE-2018-7600

CVE-2018-7600 PoC for CVE-2018-7600 Drupal SA-CORE-2018-002 Drupalgeddon 2. Installation: $ git clone https://github.com/dwisiswant0/CVE-2018-7600 $ cd CVE-2018-7600/ $ composer install Usage: $ php exploit.php WARNING! For Educational Purposes Only! References: -...

threat-hunting-guide

Corelight Threat Hunting Guide（作業用コピー） このリポジトリは、Corelight 脅威ハンティングガイドの作業データとして機能します。ここで管理されている本文は、定期的に編集、レイアウト、グラフィックデザインを経て、PDFファイルとして公開され、Corelight, Inc.（「Corelight」）によって配布されます。これらの作業には明確なスケジュールはありませんが、これまでのところ、新しいリリースは6〜12か月ごとに行われています。 最新版の Corelight 脅威ハンティングガイドをご希望の場合は、こちら から入手できます。...

Drupalgedon3

Drupal 익스플로잇 POC SA-CORE-2018-004 / CVE-2018-7602 저자 Alexandre Nguyen 사용법 usage: exploit.py -h --command --nodeid --url POC for Drupal vulnerability SA-CORE-2018-004 arguments: -h, --help show this help message and exit --command Command to inject --nodeid Node to target --url Drupal base URL 라이선...

EUVD-2026-92305

DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability. The specific flaw exists within the Configuration → Services → Music on Hold functionality...

IntelTXE-PoC

免責事項 すべての情報は教育目的でのみ提供されています。これらの手順は自己責任で実行してください。著者およびその雇用主は、このページに含まれる情報に基づいて行動した、または行動しなかった個人または組織から生じる直接的または結果的な損害または損失について一切責任を負いません。 目次 はじめに 必要なソフトウェア ペイロードの生成 ロック解除トークンの生成 SPIフラッシュイメージの準備 ファームウェアイメージへのファイル統合 OEM署名の無効化 ファームウェアイメージの構築 メインCPUの立ち上げ SPIフラッシュへのイメージ書き込み USBデバッグケーブルの準備...

CVE-2020-0568_INTEL-SA-00344

CVE-2020-0568INTEL-SA-00344 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00344.html...

CVE-2020-0557_INTEL-SA-00338

CVE-2020-0557INTEL-SA-00338 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00338.html...

CVE-2017-5689

CVE-2017-5689 탐지 스크립트 사용법: CVE-2017-5689detector.py 예시: CVE-2017-5689detector.py 192.168.1.253-255 권고: https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075...

AlmaLinux 9.2 [TuxCare] Security Update: libreswan Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1757947429)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1757947429 advisory. - An issue was discovered in Libreswan before 4.12. When an IKEv2 Child SA REKEY packet contains an invalid IPsec protocol ID number...

CentOS Linux 8.5 [TuxCare] Security Update: glibc-headers / glibc-langpack-hu / glibc-langpack-sa / etc (CENTOS8.5:CLSA-2025:1750697072)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2025:1750697072 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

EUVD-2026-88580

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

CVE-2026-102364

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

CVE-2026-102364: Improper Authentication

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

CVE-2026-102364 mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

CVE-2026-102364

The mall4j framework (through version 4.0 ) contains an improper authentication vulnerability because it fails to validate the sysType field in sa-token sessions. This flaw allows storefront customers to authenticate as back-office users by reusing their own session tokens. An attacker who regist...

CVE-2026-102364 mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

CVE-2026-102364 mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

CVE-2026-96740 Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

CVE-2026-96740

A vulnerability exists in the StreamsHub Console for Apache Kafka where tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys. This flaw allows a Console CR author to set config....