CVE-2023-34051

CVE-2023-34051 CVE-2023-34051 は、VMSA-2023-0001 のパッチを回避する認証バイパスです。 vRealize Log Insight 向け VMSA-2023-0001 には、以下の CVE が含まれています: VMware vRealize Log Insight ディレクトリトラバーサル脆弱性 CVE-2022-31706 VMware vRealize Log Insight の不適切なアクセス制御の脆弱性 CVE-2022-31704 VMware vRealize Log Insight の情報漏えいの脆弱性 CVE-2022-31711...

CVE-2023-20887

CVE-2023-20887 CVE-2023-20887 の POC: VMWare Aria Operations for Networks vRealize Network Insight の未認証RCE 技術的分析 脆弱性の根本原因分析は私のブログでご覧いただけます: https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-20887/ 概要 VMWare Aria Operations for Networks vRealize Network Insight は、Apache Thrif...

readable-thrift

Readable Thrift Readable Thriftは、バイナリ形式のThriftプロトコルメッセージを人間にわかりやすい形式に変換（およびその逆も）することで、扱いやすくします。これにより、バイナリ形式のThriftメッセージの手動分析や改ざんが、HTTPのようなプレーンテキストプロトコルを扱うのと同じくらい簡単になります。 このライブラリはJavaで実装されており、JVM上で動作するBurpやZAPなどの一般的なWebアプリケーションテストツール向け拡張機能との統合が可能です。分析ツールや改ざんツールを立ち上げて稼働させるには、適切なバイトを抽出してコーデックに渡すだけです...

vRealizeLogInsightRCE

VMSA-2023-0001 VMware vRealize Log Insight に影響する VMSA-2023-0001 の POC です。以下の CVE を含みます: VMware vRealize Log Insight ディレクトリトラバーサルの脆弱性 CVE-2022-31706 VMware vRealize Log Insight アクセス制御の不備の脆弱性 CVE-2022-31704 VMware vRealize Log Insight 情報漏えいの脆弱性 CVE-2022-31711 この脆弱性のデフォルト設定では、リバースシェルを作成する cron...

ROOT-APP-MAVEN-CVE-2026-43869 CVE-2026-43869 in org.apache.thrift:libthrift - Patched by Root

Root has patched CVE-2026-43869 in the org.apache.thrift:libthrift package for Root:Maven. Multiple fixed versions available...

Security Bulletin: IBM Guardium Data Protection is affected by security vulnerability (CVE-2026-43869)

Summary IBM Guardium Data Protection has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2026-43869 DESCRIPTION: Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended ...

CVE-2023-20887

CVE-2023-20887 CVE-2023-20887 VMWare Aria Operations for Networks vRealize Network Insight の認証不要RCEに関するPOC 技術的分析 脆弱性の根本原因分析は私のブログでご覧いただけます： https://kushagraojha.medium.com/vmware-vrealize-network-insight-cve-2023-20887-193f3c3d30a0 概要 VMWare Aria Operations for Networks vRealize Network Insight...

VMware VRealize Network Insight - Remote Code Execution

VMWare Aria Operations for Networks vRealize Network Insight is vulnerable to command injection when accepting user input through the Apache Thrift RPC interface. This vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on the underlying operating system as the ro...

ROOT-APP-PYPI-CVE-2026-43871 CVE-2026-43871 in thrift - Patched by Root

Root has patched CVE-2026-43871 in the thrift package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-41608 CVE-2026-41608 in thrift - Patched by Root

Root has patched CVE-2026-41608 in the thrift package for Root:PyPI. Multiple fixed versions available...

SUSE-SU-2026:4210-1 Security update for alloy

This update for alloy fixes the following issues: - CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs bsc1265542. - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad...

ROOT-APP-GOBINARY-CVE-2026-43871 CVE-2026-43871 in github.com/apache/thrift - Patched by Root

Root has patched CVE-2026-43871 in the github.com/apache/thrift package for Root:Go. Multiple fixed versions available...

Security Bulletin: The Network Threat Analytics App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Network Threat Analytics App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-43871 DESCRIPTION: Loop...

CVE-2026-82432 Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides

Description Nimbus validated topology.blobstore.map against the calling subject at submission time only. The rebalance operation accepts configuration overrides and stripped a small set of keys from them, but never re-ran that validation, so a caller authorised to rebalance a topology could...

Astra Linux – Vulnerability in Thrift

In Apache Thrift, all versions up to and including 0.12.0, a server or client may encounter an infinite loop when processing specific input data. Since this issue was partially addressed in version 0.11.0, it only affects certain language bindings, depending on the installed version...

Astra Linux – Vulnerability in Thrift

In Apache Thrift versions 0.9.3 to 0.13.0, malicious RPC clients could send short messages, resulting in a large memory allocation and potentially causing a denial of service...

Astra Linux – Vulnerability in Thrift

In Apache Thrift versions 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when receiving invalid input data...

Security Bulletin: Security Vulnerability identified in libthrift-0.23.0.jar used by IBM Maximo Application Suite - MREF ( CVE-2026-43871, CVE-2026-45112, CVE-2026-48586 )

Summary There is a vulnerability in libthrift-0.23.0.jar used by IBM Maximo Application Suite - MREF Vulnerability Details CVEID:CVE-2026-43871 DESCRIPTION: Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects...

PYSEC-2026-3927 Apache Thrift Python bindings have a Improper Validation of Certificate with Host Mismatch vulnerabilit

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. This replaces CVE-2026-41603...

PYSEC-2026-3925 Apache Thrift Python bindings have an Improper Handling of Highly Compressed Data (Data Amplification) vulnerability

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...