131 matches found
CVE-2023-38646
CVE-2023-38646 Burp Collectorを不要にしたkh4sh3iの フォーク CVE-2023-38646 MetabaseにおけるPre-Auth RCE: バージョン0.46.6.1未満のMetabaseオープンソース版およびバージョン1.46.6.1未満のMetabase Enterpriseでは、攻撃者がサーバ上で任意のコマンドを実行できます（サーバの権限レベルで）。認証は不要です。 使い方 python3 CVE-2023-38646.py -u http://target.com -t 349fa13d-fd94-4d9b-b54f-b4ebf2df682...
CVE-2023-38646
CVE-2023-38646 Metabase 사전 인증 RCE Metabase 오픈소스 0.46.6.1 미만 및 Metabase Enterprise 1.46.6.1 미만 버전에서 공격자가 서버 권한 수준으로 서버에서 임의의 명령을 실행할 수 있습니다. 인증이 필요하지 않습니다. 기타 수정된 버전은 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, 1.43.7.2입니다. 사용 예시 두 개의 터미널을 엽니다. 터미널 1: python3 exploit.py -u...
CVE-2023-38646
CVE-2023-38646 - Metabase RCE Metabase 오픈 소스 0.46.6.1 이전 버전과 Metabase Enterprise 1.46.6.1 이전 버전에서는 공격자가 서버의 권한 수준에서 임의의 명령을 실행할 수 있습니다. 인증 없이도 악용이 가능합니다. 그 외 수정된 버전은 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, 1.43.7.2입니다. Metabase 버전이 취약한 경우, 이 스크립트를 사용하면 공격자가 대상 시스템에서 셸 연결을 얻을 수 있습니다. 사용법...
CVE-2026-21087
Out-of-bounds write in libmdnie.so prior to SMR Sep-2026 Release 1 allows local attackers to execute arbitrary code with system server privilege...
CVE-2026-21092
Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system server privilege...
CVE-2026-21092
CVE-2026-21092 is a path traversal vulnerability in the ImsService component of Samsung mobile devices, affecting versions prior to SMR Sep-2026 Release 1 . The flaw allows remote attackers to create image files with system server privilege , potentially compromising system integrity. The assigne...
CVE-2026-21087
CVE-2026-21087 is an out-of-bounds write vulnerability in libmdnie.so , a library within Samsung Mobile's firmware. It affects devices prior to the SMR Sep-2026 Release 1 security update. A local attacker with no required privileges or user interaction can trigger the flaw to execute arbitrary co...
EUVD-2026-74628
Out-of-bounds write in libmdnie.so prior to SMR Sep-2026 Release 1 allows local attackers to execute arbitrary code with system server privilege...
PT-2026-88821
Out-of-bounds write in libmdnie.so prior to SMR Sep-2026 Release 1 allows local attackers to execute arbitrary code with system server privilege...
CVE-2026-21092: Path Traversal: '.../...//'
Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system server privilege...
CVE-2026-21087: Out-of-bounds Write
Out-of-bounds write in libmdnie.so prior to SMR Sep-2026 Release 1 allows local attackers to execute arbitrary code with system server privilege...
CVE-2026-78032
SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with the web server privilege...
CVE-2026-78032: Deserialization of Untrusted Data
SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with the web server privilege...
Open WebUI's chat completion API allows tool restrictions to be bypassed
SummaryOpen WebUI v0.6.43 contains a vulnerability in its chat completion API, which allows attackers to bypass tool restrictions, potentially enabling unauthorized actions or access. DetailsIn the chatcompletion API, the parameters toolids and toolservers are supplied by the user. These paramete...
CVE-2026-21043
Path traversal in Wallpaper service prior to SMR Jul-2026 Release 1 allows local privileged attackers to access files with system server privilege...
CVE-2026-21043
Path traversal in Wallpaper service prior to SMR Jul-2026 Release 1 allows local privileged attackers to access files with system server privilege...
CVE-2026-21043: Undefined Security Weakness
Path traversal in Wallpaper service prior to SMR Jul-2026 Release 1 allows local privileged attackers to access files with system server privilege...
Open WebUI's chat completion API allows tool restrictions to be bypassed
Summary Open WebUI v0.6.43 contains a vulnerability in its chat completion API, which allows attackers to bypass tool restrictions, potentially enabling unauthorized actions or access. Details In the chatcompletion API, the parameters toolids and toolservers are supplied by the user. These...
CVE-2026-6477
Use of inherently dangerous function PQfn..., resultisint=0, ... in PostgreSQL libpq loexport, loread, lolseek64, and lotell64 functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets, PQfn..., resultisint=0, ... stores arbitrary-lengt...