CVE-2026-101891

An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session...

CVE-2026-101891 WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access

An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session...

CVE-2026-101891

An improper access control vulnerability exists in an internal API service on WatchGuard Access Points . This flaw allows an unauthenticated attacker with network access to the access point to obtain a valid API session . No specific exploit details or remediation steps are provided in the docume...

EUVD-2026-88362

An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session...

CVE-2026-101891 WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access

An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session...

GO-2026-6482 Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation in github.com/mattermost/mattermost-server

Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation in github.com/mattermost/mattermost-server...

CVE-2026-41940_exploit

CVE-2026-41940 - cPanel & WHM 认证绕过利用工具 漏洞：cpsrvd 的 HTTP Basic 认证处理器中存在通过 CRLF 注入进行会话文件操作 CVE: CVE-2026-41940 CVSS: 9.8（严重） CWE: CWE-93（CRLF 注入）/ CWE-306（缺少认证） 受影响： cPanel & WHM 版本低于： 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, 11.136.0.5 端口：...

CVE-2026-36669-FengOffice

セキュリティアドバイザリ: CVE-2026-36669 Feng Office Community Edition における認証不要の任意ファイルアップロード Feng Office Community Edition バージョン 3.11.13.11 の ckuploadhandler.php に、認証不要の任意ファイルアップロードの脆弱性が存在します。この欠陥により、リモートの認証されていない攻撃者が、任意のファイル（悪意のある .html や .php スクリプトを含む）を Web...

soplanning-1.52-exploits

Exploit Title: SOPlanning v1.52.00 'groupesave.php' XSS Reflected XSS Application: SOPlanning Version: 1.52.00 Date: 4/22/24 Exploit Author: Joseph McPeters Liquidsky Vendor Homepage: https://www.soplanning.org/en/ Software Link: https://sourceforge.net/projects/soplanning/ Tested on: Linux CVE:...

CVE-2026-88805 Session Not Revoked Server-Side on Logout in Rancher

Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2...

CVE-2026-88805 Session Not Revoked Server-Side on Logout in Rancher

Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2...

CVE-2026-88805 Session Not Revoked Server-Side on Logout in Rancher

Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2...

CVE-2026-88805

In SUSE Rancher versions 2.15 before 2.15.2 , a vulnerability exists where incorrect credential cleaning occurs during the logout process. This flaw allows remote attackers to maintain access credentials even after an account has been logged out. The CVSS v3.1 score is 8.1 (HIGH) , indicating a h...

CVE-2024-57427

CVE-2024-57427 - 反射型跨站脚本（XSS） PHPJabbers Cinema Booking System v2.0 存在反射型跨站脚本（XSS）漏洞。多个端点对用户输入处理不当，允许恶意脚本在受害者浏览器中执行。攻击者可构造恶意链接以窃取会话 Cookie 或进行钓鱼攻击。 受影响参数： 受影响的 POST 请求功能 OPTIONS BOOKING FORM: value-enum-ocurrency value-enum-obookingstatus value-enum-opaymentstatus value-enum-opaymentdisable...

CVE-2024-22853

CVE-2024-22853 D-LINK Go-RT-AC750 GORTAC750A1FWv101b03 为 Alphanetworks 账户内置了硬编码密码，远程攻击者可借此通过 telnet 会话获取 root 访问权限。 PoC https://www.dlink.com/se/sv/products/go-rt-ac750-wireless-ac750-dual-band-easy-router?revision=deurevadownloads binwalk GORTAC750A1FWv101b03.bin -e cat...

CVE-2017-14263

HoneywellNVRvul CVE-2017-14263 xfuturesec Co., Ltd まず、ゲストユーザーのSessionIDを取得します。 SessionIDは任意のHTTPリクエストから見つけることができます。例： POST https://192.168.1.104/RPC2 HTTP/1.1 Accept: text/javascript, text/html, application/xml, text/xml X-Requested-With: XMLHttpRequest X-Request: JSON Content-Type:...

CVE-2023-0264

CVE-2023-0264 の PoC Keycloak の認可コードフロー中にセッションハイジャックを可能にする脆弱性 参照: https://github.com/advisories/GHSA-9g98-5mj6-f9mv 前提条件 Docker curl jq python3 または HTTP で静的ファイルを提供する別のツール 再現手順 1. Keycloak コンテナを ./run-keycloak-container.sh で起動する 2. ./create-users.sh で alice と mallory の2人のユーザーを作成する 3...

cyber-decoy

cyber-decoy コンテナ化されたネットワークデコイ（ハニーポット）で、SSH 、RDP 、SMB をアドバタイズし、eBPF で全ての受信接続を観測し、各セッションを隔離されたデコイコンテナにリバースプロキシします。 設計では2つの関心事を分離しています: 1. 観測. ブローカーのインターフェースにアタッチされた eBPF TC クラシファイアが、デコイが提供していないポートへのスキャンも含め、全ての受信 TCP SYN を記録します。これによりプロービングアクティビティを完全に可視化できます。 2. 対話...

USN-8829-1: Plasma Workspace vulnerability

Fabian Vogt discovered that Plasma Workspace did not properly authenticate local clients connecting to the session manager. A local attacker could possibly use this issue to execute arbitrary code as another user...

USN-8829-1 plasma-workspace vulnerability

Fabian Vogt discovered that Plasma Workspace did not properly authenticate local clients connecting to the session manager. A local attacker could possibly use this issue to execute arbitrary code as another user...