Threat matrix: Mapping threats across cloud web applications

In this article 1. Overview 2. Technique Catalog 3. Privilege Escalation 4. Mitigation and protection guidance 5. References 6. Learn more Microsoft introduces the cloud web applications threat matrix, a MITRE ATT &CK-aligned framework that helps defenders understand, prioritize, and mitigate...

symfony

Symfony es un framework de PHP para aplicaciones web y de consola, y un conjunto de componentes PHP reutilizables. Symfony es utilizado por miles de aplicaciones web y por la mayoría de los proyectos PHP populares. Instalación Instalar Symfony con Composer consulte los detalles de requisitos...

CVE-2024-24919

CVE-2024-24919 名称：CVE-2024-24919 扫描器 作者：0x.ans 联系方式：Instagram：0x.ans root@kitploit: / / | / / / / / | |/ / /-2024-24919 / |// 0xans 使用方法： root@kitploit: python3 scanner.py -x TARGET -w WORDLIST 工具描述： CVE-2024-24919 扫描器是一款 Python 工具，旨在发现 Web 应用中潜在的 CVE-2024-24919 漏洞。 选项： -h, --help：显示帮助信息并退出。 -x...

CVE-2024-2997

CVE-2024-2997 扫描器 概述 CVE-2024-2997 扫描器是一款先进漏洞扫描工具，旨在检测 Web 应用中的命令注入漏洞。此工具有助于安全专业人员识别其应用中的潜在安全风险。 免责声明 本工具仅用于教育目的 。请仅在你拥有或获得测试权限的应用程序上使用。作者不对因滥用或误用本工具造成的任何损害负责。 功能特点 高性能扫描 ：利用多线程（最多 20 个线程）实现快速扫描 全面 URL 生成 ：生成广泛的潜在易受攻击 URL 实时进度追踪 ：通过动态进度条显示扫描进度 详细报告生成 ：生成文本和 HTML 格式的扫描结果报告 漏洞分类...

Astra Linux – Vulnerability in Jetty9

In Eclipse Jetty versions 1.0 through 9.4.32.v20200930, 10.0.0alpha1 through 10.0.0.beta2, and 11.0.0alpha1 through 11.0.0.beta2O, on Unix-like systems, the system’s temporary directory is shared among all users on that system. A collocated user can observe the process of creating a temporary...

Common-Web-Application-Bug-Classes-Cheatsheet

Common Web Application Bug Classes Cheatsheet A defensive ref...

CVE-2026-67422

CVE-2026-67422 affects pymdown-extensions up to version 11.0, where four inline processors—caret, tilde, betterem, and magiclink—use regex patterns whose groups can partition delimiter runs in exponentially many ways. This causes catastrophic backtracking and unbounded CPU usage when rendering a ...

CVE-2026-67422

pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors caret, tilde, betterem, and magiclink use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways,...

CVE-2026-69149

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing...

EUVD-2026-43647

Eclipse Jetty: Path parameter traversal...

Microsoft ASP.NET Core privilege escalation vulnerability (CNVD-2026-28484)

Microsoft ASP.NET Core is a cross-platform open-source framework developed by Microsoft. This framework is used to build cloud-based applications such as web applications, IoT applications, and mobile backends. There is a permission escalation vulnerability in Microsoft ASP.NET Core, which allows...

The vulnerability of the modular interface between web servers and web applications in Rack, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the modular interface between web servers and Rack web applications is related to uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures...

[SECURITY] Fedora 43 Update: python-jupyter-server-2.20.0-1.fc43

The Jupyter Server provides the backend i.e. the core services, APIs, and REST endpoints for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila...

The vulnerability of the Next.js software platform for creating web applications, related to unlimited resource distribution, allows attackers to trigger service failures.

The vulnerability of the Next.js software platform for creating web applications is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

DEBIAN-CVE-2026-12243

NLTK version 3.9.4 is vulnerable to a path traversal attack due to an incomplete fix for GitHub Issue 3504. The UNSAFENOPROTOCOLRE regex in nltk/data.py checks for literal ../ sequences but fails to account for percent-encoded traversal sequences such as ..%2f. The url2pathname function decodes...

PYSEC-2026-394 llama_index vulnerable to SQL Injection

Multiple vector store integrations in run-llama/llamaindex version v0.12.21 have SQL injection vulnerabilities. These vulnerabilities allow an attacker to read and write data using SQL, potentially leading to unauthorized access to data of other users depending on the usage of the llama-index...

Chromium: CVE-2026-11642 Use after free in Web Apps

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Directory Traversal

Overview org.springframework:spring-webflux is a Spring Framework module that contains support for reactive HTTP and WebSocket clients as well as for reactive server web applications including REST, HTML browser, and WebSocket style interactions. Affected versions of this package are vulnerable t...

The vulnerability of the modular interface between web servers and web applications in Rack, related to the lack of protective measures for the web page structure, allows attackers to execute arbitrary code.

The vulnerability of the modular interface between web servers and Rack web applications is related to the lack of security measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

[SECURITY] Fedora 44 Update: dotnet10.0-10.0.108-1.fc44

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...