CVE-2026-85046-who-put-the-silverback-guerilla-in-the-wasm

CVE-2026-85046 이 취약점의 다른 POC를 보고, 이건 정말 보기 끔찍하다고 생각했습니다. 그래서 POC를 단순화하고 자신의 wasm으로 점프하는 기능을 추가했습니다. wasm이니까요. Chrome 152.0.7977.75는 sort 중에 객체 포인터와 정수를 혼동할 수 있습니다. poc.js는 오래된 Wasm 모듈 참조를 유지하고, 해제된 셀을 다른 모듈로 교체한 다음, 그 오래된 참조를 통해 교체된 모듈을 호출합니다. sort는 Wasm 모듈 포인터를 정수로 유출합니다. 포인터는 GC가 추적하지 않는 위치에...

trivy-module-wordpress

Trivy WoredPress 모듈 이 모듈은 Wordpress 탐지에 대한 더 심층적인 조사를 제공합니다. 설정 $ tinygo build -o wordpress.wasm -scheduler=none -target=wasi --no-debug wordpress.go $ mkdir -p /.trivy/modules $ cp wordpress.wasm /.trivy/modules 또한 GHCR에서 사용할 수 있습니다. trivy module install을 통해 설치할 수 있습니다. $ trivy module install...

Exploit for Type Confusion in Google Chrome

CVE-2026-85046 Saw the other POC of this and I thought to mys...

MAL-2026-10404 Malicious code in @ica-gaming/slot-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 504d38d63d27d90e825007078cde3c381daa6cfa73a8009797c60f3e889c44d0 The package presents itself as a deterministic WASM slot-math engine, but slotengine.wasm embeds obfuscated Node.js modules and Emscripten JS shim...

CVE-2026-26056 Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC

Yoke is a Helm-inspired infrastructure-as-code IaC package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic Controller ATC component of Yoke. It allows users with CR create/update permissions to execute arbitrary WASM code in the ATC controller context by injecting a...

CVE-2026-26055: Missing Authentication for Critical Function

Yoke is a Helm-inspired infrastructure-as-code IaC package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic Controller ATC component of Yoke. The ATC webhook endpoints lack proper authentication mechanisms, allowing any pod within the cluster network to directly send...

Exploit for Type Confusion in Google Chrome

CVE-2024-2887 This is a short writeup for the CVE-2024-2887,...

BIT-GOLANG-2021-38297

Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used...

nodejs: code injection via WebAssembly export names

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module...

Denial Of Service (DoS)

firefox and thunderbird are vulnerable to Information Disclosure. An attacker could exploit this vulnerability by creating a malicious website that would contain a specially crafted WASM module when Firefox tried to compile the module, it would crash...

Important: golang

Issue Overview: A null pointer dereference vulnerability was found in golang. When using the library's ssh server without specifying an option for GSSAPIWithMICConfig, it is possible for an attacker to craft an ssh client connection using the authentication method and cause the server to panic...

Amazon Linux AMI : golang (ALAS-2022-1583)

The version of golang installed on the remote host is prior to 1.16.15-1.37. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1583 advisory. 2024-01-03: CVE-2021-27919 was added to this advisory. An out of bounds read vulnerability was found in golang. When...

EulerOS 2.0 SP10 : golang (EulerOS-SA-2022-1254)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler...

EulerOS 2.0 SP8 : golang (EulerOS-SA-2021-2802)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected ty...

CVE-2021-38297

Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used...

AZL-6450 CVE-2021-38297 affecting package golang for versions less than 1.17.8-1

Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used...

DEBIAN-CVE-2021-38297

Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used...

Buffer overflow

Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used...

CVE-2021-38297

Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used...

CVE-2021-38297: Buffer Copy without Checking Size of Input

Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used...