cve-2021-22146

cve-2021-22146 Я обнаружил во время внутреннего пентеста уязвимость в elastic ECE. Elasticdump — это PoC для CVE-2021-22146, позволяющий выгрузить базу данных из elastic ece с версии 7.10.0 до 7.13.3. https://www.exploit-db.com/exploits/50152 Соавторы: Mario Díaz Caldera...

CVE-2025-24016

CVE-2025-24016 Как работает этот метод обнаружения? Этот HTTP-шаблон Nuclei проверяет целевой URL и его страницу /app/login на наличие веб-интерфейса Wazuh, извлекает значение wazuhVersion с помощью регулярного выражения и подтверждает, что страница доступна статус 200 и действительно является...

safer-eval-cve-CVE-2019-10760

safer-eval-cve-CVE-2019-10760 Следующий эксплойт доказательства концепции POC, нацеленный на версию safer-eval 1.3.1 и ниже, является первой публично известной нагрузкой для атаки на этот диапазон версий. Вклад Пожалуйста, обратитесь к CONTRIBUTING для получения рекомендаций по внесению вклада в...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

The “Use After Free” vulnerability in the Linux kernel allows for the execution of code in a local environment on Linux, x86, and ARM bluetooth modules. This vulnerability is associated with program files located at https://gitee.com/anolis/cloud-kernel/blob/devel-5.10/net/bluetooth/afbluetooth.C...

Astra Linux – Vulnerability in u-boot

In Das U-Boot versions 2016.11-rc1 through 2019.07-rc4, an underflow can cause memcpy to overwrite a very large amount of data including the entire stack, while reading a crafted ext4 filesystem...

Astra Linux – Vulnerability in Tomcat9

An improper authorization vulnerability in Apache Tomcat leads to security constraints that ignore any methods or method omissions configured as part of the constraints. This issue affects Apache Tomcat versions from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through...

Astra Linux – Vulnerability in curl

There is an improper authentication vulnerability in curl versions 7.33.0 through and including 7.82.0. This vulnerability may allow for the reuse of OAUTH2-authenticated connections without ensuring that the connection was authentically verified with the same credentials used for this transfer...

Astra Linux – Vulnerability in curl

curl 7.1.1 up to and including 7.75.0 is vulnerable to a “Exposure of Private Personal Information to an Unauthorized Actor” by leaking credentials in the HTTP Referer: header. libcurl does not remove user credentials from the URL when automatically filling in the Referer: HTTP request header fie...

Astra Linux – Vulnerability in Tomcat9

In some unusual configurations of multipart uploads, an Integer Overflow vulnerability in Apache Tomcat can lead to a Denial-of-Service attack by bypassing size limits. This issue affects Apache Tomcat versions from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, and from 9.0.0.M1 throu...

Astra Linux – Vulnerability in libmysofa

Incorrect handling of input data in the loudness function of the libmysofa library in versions 0.5 to 1.1 can lead to heap buffer overflows and access to unallocated memory blocks...

Astra Linux – Vulnerability in Mutt

Null pointer dereferencing when composing from a specially crafted draft message in Mutt 1.5.2 2.2.12...

Astra Linux – Vulnerability in libproxy

In url.cpp within libproxy versions 0.4.x to 0.4.15, it is possible for a remote HTTP server to trigger uncontrolled recursion by sending a response that consists of an infinite stream without a newline character. This leads to a stack exhaustion issue...

Astra Linux – Vulnerability in Tomcat9

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protections provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65...

Astra Linux – Vulnerability in Linux, Linux 5.10

A flaw involving a null pointer dereference was discovered in the Linux kernel’s UDF file system functionality. This flaw allows a malicious UDF image to trigger the udffilewriteiter function. A local user could exploit this flaw to crash the system. The flaw is present in the Linux kernel versio...

Astra Linux – Vulnerability in Subversion

Subversion’s moddavsvn is vulnerable to memory corruption. When checking path-based authorization rules, moddavsvn servers may attempt to use memory that has already been freed. Affected Subversion moddavsvn servers include versions 1.10.0 through 1.14.1 including those versions. Servers that do...

CVE-2026-56390 affecting package bison for versions less than 3.8.2-2

CVE-2026-56390 affecting package bison for versions less than 3.8.2-2. A patched version of the package is available...

CVE-2026-63074 affecting package openssl for versions less than 3.3.7-6

CVE-2026-63074 affecting package openssl for versions less than 3.3.7-6. A patched version of the package is available...

CVE-2026-78126

CVE-2026-78126 affects strongSwan (an IKE/IPsec suite), versions 4.1.10 through 6.0.7 . The vulnerability is a NULL-pointer dereference in the eap-aka plugin triggered when processing an unexpected AKA-Synchronization-Failure message, which can result in a crash (denial of service). The CVSS 3.1 ...

CVE-2026-74994 affecting package erlang for versions less than 26.2.5.21-6

CVE-2026-74994 affecting package erlang for versions less than 26.2.5.21-6. A patched version of the package is available...

CVE-2026-63076 affecting package edk2 for versions less than 20240524git3e722403cd16-19

CVE-2026-63076 affecting package edk2 for versions less than 20240524git3e722403cd16-19. A patched version of the package is available...