2912438 matches found
Adobe ColdFusion - Deserialization of Untrusted Data
Adobe ColdFusion versions 2018u17 and earlier, 2021u7 and earlier and 2023u1 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. id: CVE-2023-38203 info: name:...
MOVEit Transfer - Remote Code Execution
In Progress MOVEit Transfer before 2021.0.6 13.0.6, 2021.1.4 13.1.4, 2022.0.4 14.0.4, 2022.1.5 14.1.5, and 2023.0.1 15.0.1, a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database...
Atlassian Bitbucket - Remote Command Injection
Atlassian Bitbucket Server and Data Center is susceptible to remote command injection. Multiple API endpoints can allow an attacker with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request, thus making it possible to obtain...
CraftCMS - Remote Code Execution
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity...
rConfig 3.9 - SQL Injection
An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter. id: CVE-2020-10220 info: name: rConfig 3.9 - SQL Injection author: ritikchaddha,theamanrawat severity: critical description: | An issue was discovered i...
Apache OFBiz - Improper Authorization & Remote Code Execution
Improper Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met...
Oracle Fusion - Directory Traversal/Local File Inclusion
Oracle Business Intelligence Enterprise Edition 5.5.0.0.0, 12.2.1.3.0, and 12.2.1.4.0 are vulnerable to local file inclusion vulnerabilities via "getPreviewImage." id: CVE-2020-14864 info: name: Oracle Fusion - Directory Traversal/Local File Inclusion author: Ivo Palazzolo @palaziv severity: high...
SAP Solution Manager 7.2 - Remote Command Execution
SAP Solution Manager SolMan running version 7.2 has a remote command execution vulnerability within the SAP EEM servlet tcsmdagentapplicationeem. The vulnerability occurs due to missing authentication checks when submitting SOAP requests to the /EemAdminService/EemAdmin page to get information...
Jira Server and Data Center - Information Disclosure
Jira Server and Data Center is susceptible to information disclosure. An attacker can enumerate users via the QueryComponentRendererValue!Default.jspa endpoint and thus potentially access sensitive information, modify data, and/or execute unauthorized operations, Affected versions are before...
PAN-OS Management Web Interface - Command Injection
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability. id: CVE-2024-9474 info...
Zabbix---CVE-2024-42327
This repository does not have a README...
CVE-2024-38063
CVE-2024-38063...
dsiem
Dsiem Dsiem is a security event correlation engine for ELK stack, allowing the platform to be used as a dedicated and full-featured SIEM system. Dsiem provides OSSIM-style correlation for normalized logs/events, perform lookup/query to threat intelligence and vulnerability information sources, an...
awesome-rust-security
Awesome Rust Security 精选的与 Rust 和计算机安全相关的优秀项目与资源列表 目录 工具 Web 与云安全 漏洞评估 进攻性安全与红队 威胁检测与取证 密码学 应用程序 教育 书籍 文章 讲座 类似列表 贡献 工具 Web 与云安全 渗透测试 sn0int - OSINT 框架与包管理器 sniffglue - 安全的多线程数据包嗅探器 badtouch - 可脚本化的网络认证破解器 rshijack - TCP 连接劫持器 feroxbuster - 快速、简单且递归的内容发现工具 - Web 模糊测试与内容发现工具...
BloodHound-Tools
这是什么？ 一组集成到 BloodHound 的工具集。 BloodHound 是蓝队和红队安全团队用于发现企业环境中可能被利用的横向移动和权限提升路径的事实标准。典型环境可能产生数百万条路径，为红队提供了几乎无穷无尽的攻击机会，同时也给蓝队带来了看似不可逾越的攻击向量数量。 然而，BloodHound 忽略了一个关键维度——网络访问——这可能是阻断过度横向移动的关键。本仓库包含的工具可与 BloodHound 的数据库集成，以反映网络访问情况，惠及红蓝双方。 阅读更多 此处。 工具列表 ShotHound 使用 CornerShot 验证 BloodHound 发现的可行路径。...
gha-lab-360f77d0d4
自动化研究产物 — 非上游项目。 本仓库是由自动化工具链为拉瓦尔大学（Université Laval）硕士论文构建的一次性实验环境，用于复现已发表的 GitHub Actions 工作流漏洞。它是 LawnchairLauncher/lawnchair 在提交 b089bae8c007f36a8ce0346725182a107d97cd05（2026-04-05）时的逐字快照，依据该项目自身的许可证重新分发，该许可证文件已原样包含在本快照中。 上游项目未 参与其中，也从未...
CVE-2022-2588
CVE-2022-2588...
cve-2016-9838
CVE-2016-9838 这是Cved的一部分： 一个管理易受攻击的Docker容器的工具。 Cved: https://github.com/git-rep-src/cved 图片来源：https://github.com/cved-sources/cve-2016-9838 图片作者：https://github.com/cved-sources/cve-2016-9838...