linux_mint_poc

Linux Mint 18.3-19.1 'yelp' 명령 삽입 버그 근본 원인 URI 핸들러 help://, ghelp://, man://는 /usr/share/applications/yelp.desktop 파일에 정의되어 있으며, 해당 URI 핸들러 중 하나가 호출될 때마다 Exec=yelp %u를 통해 /usr/local/bin/yelp를 실행합니다. /usr/local/bin/yelp 파일은 수신된 URI 핸들러 요청을 구문 분석하는 간단한 파이썬 스크립트입니다. 이 스크립트는 먼저 "gnome-help" 및...

CVE-2024-41997

Warp 터미널 RCE CVE-2024-41997 sanitize되지 않은 warp:// URI 스킴 핸들러를 통한 명령 삽입. 전체 분석 글은 0day.gg에서 확인 가능합니다. 요약 속성| 값 ---|--- CVE| CVE-2024-41997 취약점| 명령 삽입 CWE-77 대상| Warp 터미널 macOS 영향받는 버전| v0.2024.07.16.08.02 영향| 임의 명령 실행 인증 필요| 없음 1-클릭 공격 벡터| 악성 warp:// URL 취약점 Warp는 Docker 통합을 위해 사용자 정의 warp:// URI...

cve-2025-59489

Unity CVE-2025-59489 취약점 탐지 도구 Android 게임 플랫폼 전용 Unity 런타임 주입 취약점 자동 탐지 도구입니다. 취약점 개요 CVE ID : CVE-2025-59489 CVSS 점수 : 8.4 High 영향 범위 : Unity 2017.1 이상 버전으로 빌드된 Android 앱 공식 공지 : https://unity.com/security/sept-2025-01 취약점 위험 상세 위험 상한 최악의 경우 한 줄 요약 : 공격자가 영향을 받는 Unity 게임/앱을 완전히 제어하고, 해당 앱의 모든 권한...

CVE-2022-30190-Follina-Lab

🔴 CVE-2022-30190 — Follina MSDT RCE 실험실 연구자: Abhimanyu Rawat 역할: 기술 연구 및 사이버 보안 운영 인턴 날짜: 2026년 5월 8일 📌 Follina란? CVE-2022-30190 별칭 "Follina"는 Microsoft Windows의 제로데이 원격 코드 실행RCE 취약점으로, 공격자가 피해자가 Word 문서를 열기만 하면 매크로 없이도 임의의 명령을 실행할 수 있습니다. 이 취약점은 Microsoft Office의 외부 템플릿 기능을 통해 합법적인 Windows 진단...

CVE-2026-19503

MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled...

MySQL MCP Server is Vulnerable to SQL Injection Through its mysql URI Handler

A vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2. The impacted element is the function readresource of the file src/mysqlmcpserver/server.py of the component mysql URI Handler. This manipulation of the argument uristr causes sql injection. Remote exploitation of the...

PYSEC-2026-3579 MySQL MCP Server is Vulnerable to SQL Injection Through its mysql URI Handler

A vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2. The impacted element is the function readresource of the file src/mysqlmcpserver/server.py of the component mysql URI Handler. This manipulation of the argument uristr causes sql injection. Remote exploitation of the...

GHSA-MVQ4-39WX-6H5G MySQL MCP Server is Vulnerable to SQL Injection Through its mysql URI Handler

A vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2. The impacted element is the function readresource of the file src/mysqlmcpserver/server.py of the component mysql URI Handler. This manipulation of the argument uristr causes sql injection. Remote exploitation of the...

MySQL MCP Server is Vulnerable to SQL Injection Through its mysql URI Handler

A vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2. The impacted element is the function readresource of the file src/mysqlmcpserver/server.py of the component mysql URI Handler. This manipulation of the argument uristr causes sql injection. Remote exploitation of the...

CVE-2026-11529 designcomputer mysql-mcp-server mysql URI server.py read_resource sql injection

A vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2. The impacted element is the function readresource of the file src/mysqlmcpserver/server.py of the component mysql URI Handler. This manipulation of the argument uristr causes sql injection. Remote exploitation of the...

CVE-2026-11529: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2. The impacted element is the function readresource of the file src/mysqlmcpserver/server.py of the component mysql URI Handler. This manipulation of the argument uristr causes sql injection. Remote exploitation of the...

Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashes

Cybersecurity researchers have disclosed details of an unpatched issue that could be exploited to disclose a user's NTLMv2 hash to the attacker. Like in the case of CVE-2026-33829, which impacted the Windows Snipping Tool's ms-screensketch: URI handler, the newly flagged issue resides in the...

CVE-2026-30793

Cross-Site Request Forgery CSRF vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android Flutter URI scheme handler, FFI bridge modules allows Privilege Escalation. This vulnerability is associated with program files flutter/lib/common.Dart,...

EUVD-2026-9827

Cross-Site Request Forgery CSRF vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android Flutter URI scheme handler, FFI bridge modules allows Privilege Escalation. This vulnerability is associated with program files flutter/lib/common.Dart,...

CVE-2026-30797

Missing Authorization vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android Flutter URI scheme handler, config import modules allows Application API Message Manipulation via Man-in-the-Middle. This vulnerability is associated with program files...

CVE-2026-30793

Cross-Site Request Forgery CSRF vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android Flutter URI scheme handler, FFI bridge modules allows Privilege Escalation. This vulnerability is associated with program files flutter/lib/common.Dart,...

CVE-2026-30797

Missing Authorization vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android Flutter URI scheme handler, config import modules allows Application API Message Manipulation via Man-in-the-Middle. This vulnerability is associated with program files...

CVE-2026-30797 RustDesk rustdesk://config/ URI Silently Re-homes Client to Attacker-Controlled Server

Missing Authorization vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android Flutter URI scheme handler, config import modules allows Application API Message Manipulation via Man-in-the-Middle. This vulnerability is associated with program files...

CVE-2026-30797

CVE-2026-30797 describes a Missing Authorization vulnerability in the RustDesk Client (rustdesk-client) across Windows, macOS, Linux, iOS, and Android. The issue involves the Flutter URI scheme handler and config import modules, permitting Application API Message Manipulation via Man-in-the-Middl...

CVE-2026-30793

The CVE-2026-30793 entry concerns RustDesk Client (rustdesk-client) on Windows, macOS, Linux, iOS, Android (Flutter URI scheme handler, FFI bridge modules). A Cross-Site Request Forgery (CSRF) vulnerability affects the client via rustdesk://password/ flows and related program routines (flutter/li...