Reg1c1de

Reg1c1de: Windows 레지스트리 권한 상승 스캐너 요약 도움말 출력에서: Reg1c1de는 지정된 레지스트리 하이브를 스캔하여 사용자에게 쓰기 권한이 있는 모든 키를 보고하는 도구입니다. 또한 특정 파일 확장자를 가진 파일 경로를 포함하는 레지스트리 값이 발견되고 해당 경로에 쓰기 가능한 경우, 이 역시 보고됩니다. 이 도구와 그 사용법에 대한 자세한 정보는 관련 github.io 문서에서 확인할 수 있습니다: 여기 도움말 출력: ++++++++++++++Reg1c1de++++++++++++++++ +author:...

enum_shares

enumshares 共有フォルダ列挙ツール EnumShares は、ネットワーク上およびカスタムユーザーアカウントで共有フォルダを列挙します。現在のユーザーに対して共有フォルダが書き込み可能かどうかを確認できます。全員または特定のユーザー（グループメンバー）に「書き込み」を許可するディレクトリを発見する必要がある場合、多くの時間を節約できます。 構文は次のとおりです: enumshares.py -t 10.10.10.0/24 -u mydomain\myuser -p Password -w -o logfile.txt または enumshares.py -t...

CVE-2023-33829

CVE-2023-33829: Stored-XSS-on-SCM-Manager-1.60 概要 SCM Manager 1.2 = 1.60 バージョンに脆弱性が発見されました。書き込み権限を持つ認証済みの攻撃者が、特定のフィールドで JavaScript コードを実行できるようになります。 この Proof of Concept は、docker を使用して SCM Manager 1.60 をデプロイしたローカル環境で作成されました。 CVE 公開情報:...

rabbitmq-server: rabbitmq-server: Unauthorized message routing via missing alternate-exchange permission check

A flaw was found in rabbitmq-server. This vulnerability allows an authenticated user to bypass access controls and perform unauthorized message routing. When an exchange is declared via the Advanced Message Queuing Protocol AMQP 1.0 management interface, the application fails to verify write...

CVE-2026-77827

Maono Link version 3.8.13 contains a local privilege escalation vulnerability in its MaonoAiServices Windows service. The root cause is improper write permissions on C:\ProgramData\Maono, allowing a standard user to modify service files and escalate privileges. The CVSS 3.1 score is 7.1 (HIGH) an...

CVE-2026-84942 Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards

Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The...

CVE-2026-84942 Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards

Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The...

PT-2026-88425

Maono Link 3.8.13 MaonoAiServices Windows service allows local privilege escalation for a standard user account via improper write privileges in 'C:ProgramDataMaono'. Fixed in 4.0.80...

CVE-2026-84942: Improper Neutralization of Input During Web Page Generation

Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The...

CVE-2026-12663 ControlFLASH ® – Improper Access Control

A security issue exists within ControlFLASH™, where the installer grants write permissions to the "Everyone" group on a product installation directory. This could allow arbitrary code execution, resulting in an attacker being given the ability to run any commands or code of the attacker's choice ...

CVE-2026-12663 ControlFLASH ® – Improper Access Control

A security issue exists within ControlFLASH™, where the installer grants write permissions to the "Everyone" group on a product installation directory. This could allow arbitrary code execution, resulting in an attacker being given the ability to run any commands or code of the attacker's choice ...

EUVD-2026-69136

A security issue exists within ControlFLASH™, where the installer grants write permissions to the "Everyone" group on a product installation directory. This could allow arbitrary code execution, resulting in an attacker being given the ability to run any commands or code of the attacker's choice ...

CVE-2026-12663: Missing Authentication for Critical Function

A security issue exists within ControlFLASH™, where the installer grants write permissions to the "Everyone" group on a product installation directory. This could allow arbitrary code execution, resulting in an attacker being given the ability to run any commands or code of the attacker's choice ...

PT-2026-84212

Name of the Vulnerable Software and Affected Versions ControlFLASH versions 15.07 and earlier Description The installer grants write permissions to the Everyone group on the product installation directory. This flaw allows for arbitrary code execution, enabling an attacker to run any commands or...

CVE-2026-33047

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3...

CVE-2026-33047 Combodo iTop: Object can be locked by a user without write permissions

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3...

CVE-2026-33047 Combodo iTop: Object can be locked by a user without write permissions

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3...

CVE-2026-33047

Combodo iTop (a web-based IT service management tool) is affected by a permission bypass in versions prior to 3.2.3 . A user without write permissions can lock an object, which may disrupt other users' ability to modify that object. The CVSS 3.1 score is 4.3 (MEDIUM) , reflecting a low availabili...

EUVD-2026-64174

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3...

CVE-2026-33047 Combodo iTop: Object can be locked by a user without write permissions

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3...