CVE-2017-11882

CVE-2017-11882 CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882 MITRE CVE-2017-11882: https://vulners.com/cve/CVE-2017-11882 研究: https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about パッチ分析:...

rpc2wc

RPC から WebClient へ このコードの情報はこちらのブログ記事にあります。ここにあるものを使用する前に読むことをお勧めします。 RPC 呼び出しを介して WebClient をトリガーするためのコードです。結局うまくいかなかったため、コードはあまり整理されておらず、概念実証 proof of concept の状態のままです。 以下の RPC 呼び出しは、サービスを開始するコードパスに到達できます: EfsRpcDuplicateEncryptionInfoFileDownlevel - EfsDuplicateEncryptionInfoRPCClient -...

IceWarp Email Client - Cross Site Scripting

Cross Site Scripting vulnerability in IceWarp Corporation WebClient v.10.2.1 allows a remote attacker to execute arbitrary code via a crafted payload to the mid parameter. id: CVE-2023-39598 info: name: IceWarp Email Client - Cross Site Scripting author: Imjust0 severity: medium description: |...

netty-resolver-dns-check

netty-resolver-dns-check 针对 io.netty:netty-resolver-dns 中三个 DNS 缓存投毒 CVE 的离线检查工具—— CVE-2026-45674 、CVE-2026-47691 和 CVE-2026-45673 ——并回答版本号无法回答的问题： 你的应用是否真的在使用该解析器？ 如果你使用 Spring WebClient，答案很可能是肯定的，即使 netty-resolver-dns 并未出现在你的 pom.xml 中，代码中也没有任何地方调用它。 java -jar netty-resolver-dns-check-0.1.0.jar...

CVE-2025-33053-Checker-PoC

CVE-2025-33053 脆弱性チェッカー＆概念実証 PoC チェッカーの証明 PoCの証明 Windows システムに影響を与える、WebDAV ベースの重要なリモートコード実行 RCE 脆弱性 CVE-2025-33053 の悪用可能性をチェックし、実証するためのツール一式です。 📌 CVE-2025-33053 について CVE-2025-33053 は、攻撃者が悪意のあるリモート WebDAV 共有を参照する .LNK ショートカットファイルを悪用し、影響を受けるシステム上でリモートコード実行 RCE を引き起こす可能性を許容します。 脆弱性の条件： 対象に WebClien...

SharpStartWebclient

SharpStartWebclient 从非特权会话运行，以启动 WebClient 服务并实现绝妙的提权。 Beacon Object File 的 C 移植版本，源自 https://github.com/outflanknl/C2-Tool-Collection/blob/main/BOF/StartWebClient/SOURCE/StartWebClient.c...

CVE-2026-83276

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webclient-http2. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of...

CVE-2026-83276

CVE-2026-83276 affects the helidon-webclient-http2 component of Oracle Helidon (part of Oracle Fusion Middleware), versions 4.0.0 through 4.5.4 . An unauthenticated attacker with network access via HTTP/2 can trigger a hang or frequently repeatable crash, resulting in a complete denial of service...

EUVD-2026-79628

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webclient-http2. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of...

PT-2026-92798

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon versions 4.0.0 through 4.5.4 Description A flaw in the helidon-webclient-http2 component allows an unauthenticated attacker with network access via HTTP/2 to compromise the system. This can lead to a hang or a...

CVE-2026-83276: Uncontrolled Resource Consumption

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webclient-http2. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of...

CVE-2026-72965

Use after free in Windows WebClient Service allows an authorized attacker to elevate privileges locally...

EUVD-2026-73894

Use after free in Windows WebClient Service allows an authorized attacker to elevate privileges locally...

CVE-2026-72965

CVE-2026-72965 is a use-after-free vulnerability in the Windows WebClient Service that allows an authorized local attacker to achieve privilege elevation . The CVSS v3.1 score is 7.8 (HIGH) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack requiring low privileges an...

Windows WebClient Service Elevation of Privilege Vulnerability

Use after free in Windows WebClient Service allows an authorized attacker to elevate privileges locally...

PT-2026-87880

Use after free in Windows WebClient Service allows an authorized attacker to elevate privileges locally...

CVE-2026-72965: Use After Free

Use after free in Windows WebClient Service allows an authorized attacker to elevate privileges locally...

io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation

A flaw was found in Eclipse Vert.x Web Client. The WebClientSession component does not properly validate the Domain attribute of a Set-Cookie response header against the originating server's domain. This vulnerability allows a remote attacker to inject a cookie scoped to an arbitrary third-party...

CVE-2026-44768

Summary: CVE-2026-44768 affects the SAP CRM WebClient UI. The vulnerability arises from the absence of a Content Security Policy (CSP) configuration for certain restrictive directives, enabling an attacker to inject and execute malicious scripts in the application context. According to the source...

EUVD-2026-43592

SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Content Security Policy CSP configuration for certain restrictive directives. This vulnerability has a low impact on the integrity of the application...