316 matches found
WPTaskScheduler_CVE-2024-49039
WPTaskScheduler Persistenz & CVE-2024-49039, als einer der Angriffsflächen innerhalb des Taskplaners. WPTaskScheduler.dll ist eine Komponente des Taskplaners, seit Windows 10 1507. Dies ist wahrscheinlich ein Backdoor-Tool zur Persistenz, das von Sicherheitsforschern analysiert wurde, die...
CVE-2022-44721-CsFalconUninstaller
CVE-2022-44721 Crowdstrike Falcon Disinstallatore CrowdStrike Falcon è una soluzione di endpoint detection and response EDR e antivirus AV basata su cloud. Su ogni dispositivo finale viene distribuito un sensore gestito a livello kernel che sfrutta le capacità cloud. Il sensore può essere...
CVE-2022-1388
CVE-2022-1388 Vulnerabilità REST iControl di BIG-IP CVE-2022-1388 Utilizzo Questa POC è verificata! curl -i -s -k -X $'POST' \ -H $'Host: localhost' -H $'Connection: keep-alive, X-F5-Auth-Token' -H $'Authorization: Basic YWRtaW46' -H $'X-F5-Auth-Token: a' -H $'Content-Length: 39' \ --data-binary...
CVE-2025-63667
CVE-2025-63667 — Evidenza di vulnerabilità per telecamere IP basate su Vatilon Sanitizzata Riepilogo Diverse telecamere IP basate su Vatilon marchi osservati: SIMICAM, KEVIEW, ASECAM rilasciano token Session-Id senza verificare la correttezza delle credenziali. Questa falla consente a utenti non...
[SECURITY] [DSA 6547-1] ruby-jwt security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6547-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 06, 2026 https://www.debian.org/security/faq -...
CVE-2026-56291
CVE-2026-56291 — Exploit RCE di massa per Balbooa Forms su Joomla Pre-Auth form.uploadAttachmentFile → Nessun CSRF → Upload PHP Panoramica CVE-2026-56291 è una vulnerabilità critica CVSS 9.8 di caricamento arbitrario di file senza autenticazione nell'estensione Joomla Balbooa Forms combaforms CIS...
Bludit-3.9.2-Auth-Bruteforce-Bypass-CVE-2019-17240
Script di Bypass della Mitigazione Brute Force di Bludit Panoramica Questo script è un'implementazione Bash rinnovata di un exploit che colpisce il CMS Bludit versione = 3.9.2. Sfrutta una vulnerabilità CVE-2019-17240 che permette di forzare le password bypassando la protezione basata su token...
Rocky Linux 8 [CIQ] Security Update: mailman / mailman-debuginfo / mailman-debugsource (crlsa-2021_4916)
The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20214916 advisory. mailman: CSRF token bypass allows to perform CSRF attacks and admin takeover CVE-2021-44227 Tenable has extracted the preceding description block directly from the...
CVE-2026-97846
Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this...
CVE-2026-97846
Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this...
EUVD-2026-85031
The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know...
CVE-2026-91164 Warpgate: API tokens bypass the user's allowed_ip_ranges restriction
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validateapitoken into RequestAuthorization::UserToken without enforcing the owning user's allowedipranges against the trusted client address in...
CVE-2024-11680
ProjectSend CVE-2024-11680 エクスプロイト これは、ProjectSend における CVE-2024-11680 の概念実証エクスプロイトです。この脆弱性は認証不要の設定変更とウェブシェルのアップロードを可能にします。 説明 このエクスプロイトは ProjectSend の複数の脆弱性を利用します: CSRFトークンのバイパスによる設定変更 安全でないクライアント登録設定 無制限のファイルアップロードによるリモートコード実行 必要条件 Python 3.x 必要な Python パッケージ: root@kitploit: pip install request...
EUVD-2026-79180
Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details single-page controller resolved a board instance directly from an attacker-supplied instance ID and then viewed, refreshed, regenerated, ...
PT-2026-92401
Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details single-page controller resolved a board instance directly from an attacker-supplied instance ID and then viewed, refreshed, regenerated, ...
EUVD-2026-77596
PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAICALLAUTH to disabled makes verifytoken accept requests to /api/v1/agents/id/invoke without CALLSERVERTOKEN authentication. Deployments that use the application's advertised opt-out can expose registered agents and their...
Astra Linux – Vulnerability in open-vm-tools
VMware Tools contains a vulnerability related to bypassing the SAML token signature. A malicious actor who has been granted “Guest Operation Privileges” can potentially elevate their privileges if the target virtual machine has been assigned a more privileged “Guest Alias”. source-iocs-preserved...
CVE-2026-82879
DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another ShareTicketManage.validateTicket / POST /de2api/share/proxyInfo. The POST...
PT-2026-83783
DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another ShareTicketManage.validateTicket / POST /de2api/share/proxyInfo. The POST...
