169045 matches found
TVT DVR Sensitive Device - Information Disclosure
A vulnerability has been found in TVT DVR TD-2104TS-CL, DVR TD-2108TS-HP, Provision-ISR DVR SH-4050A5-5LMM and AVISION DVR AV108T and classified as problematic. This vulnerability affects unknown code of the file /queryDevInfo. The manipulation leads to information disclosure. id: CVE-2024-7339...
CVE-2026-11106-DNS-Zone-Transfer-AXFR-Information-Disclosure
CVE-2026-11106 – DNS 区域传送 AXFR 信息泄露 程序代码（Python DNS 服务器 + 攻击） root@kitploit: dnsserversim.py - Simulated DNS server allowing AXFR from dnslib import DNSRecord, QTYPE, RR, TXT, A import socketserver, socket class DNSHandlersocketserver.BaseRequestHandler: def handleself: data, sock = self.request...
kemon
Kemon An Open Source Pre and Post Callback-based Framework for macOS Kernel Monitoring. Breaking News - 08/28/2019 macOS Catalina 10.15 Beta 7 Release Notes https://developer.apple.com/documentation/macosreleasenotes/macoscatalina1015beta7releasenotes Endpoint Security The kauth API has been...
authcov
AuthCov Web 应用程序授权覆盖扫描。 简介 AuthCov 使用 Chrome 无头浏览器，以预定义用户的身份登录，爬取您的 Web 应用程序。在爬取阶段，它会拦截并记录 API 请求以及加载的页面。下一阶段，它会以另一个用户账户（即“入侵者”）登录，并尝试访问之前发现的每一个 API 请求或页面。对于定义的每个入侵者用户，重复此步骤。最后，它会生成一份详细报告，列出发现的资源以及入侵者用户是否能够访问这些资源。 扫描本地 Wordpress 实例生成的示例报告： 功能特性 支持单页应用和传统多页应用 处理基于令牌和基于 Cookie 的身份验证机制 生成 HTML 格式的深入...
CVE-2026-25049
🚨 CVE-2026-25049 – n8n 未授权设置泄露 📌 概述 CVE 编号： CVE-2026-25049 受影响软件： n8n 严重性： 严重 类别： 不当访问控制 / 信息泄露 该漏洞允许在某些 n8n 部署中通过 REST API 端点未授权访问 内部配置数据。 🧭 目录 概述 技术详情 影响 受影响版本 验证 缓解措施 安全说明 免责声明 🔍 技术详情 在易受攻击的配置中，以下端点无需身份验证即可访问： root@kitploit: GET /rest/settings 📤 可能泄露的数据包括 🔐 身份验证方法（例如，电子邮件登录） 🌐 实例模式（例如，public） ...
CVE-2026-89151
Forgejo before 16.0.4 is affected by a vulnerability allowing restricted API tokens to be used for unintended access to the "allow maintainer edit" feature. The CVSS 3.1 score is 3.5 (LOW) , with a vector of AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N, indicating a network attack requiring low privileges...
EUVD-2026-75922
Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...
CVE-2026-89151
Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...
CVE-2026-78134
strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity...
DEBIAN-CVE-2026-78134
strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity...
AZL-100034 CVE-2026-78134 affecting package strongswan 5.9.14-10
strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity...
CVE-2026-78134
strongSwan versions 4.5.0 through 6.0.7 contain an Incorrect Access Control vulnerability in the eap-ttls and eap-peap plugins caused by missing or mismatched inner EAP identity authentication details. This can result in incorrect identity binding and a potential authorization bypass . The CVSS 3...
CVE-2026-78134
strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity...
CVE-2026-78134
strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity...
EUVD-2026-75920
strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity...
CVE-2026-78134
strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity...
CVE-2025-15260
CVE-2025-15260：插件 MyRewards – WooCommerce 忠诚度积分与奖励中的授权缺失/访问控制失效 免责声明： 本仓库仅用于教育目的及负责任的披露 。该漏洞已向厂商报告并获得修复。请勿利用此信息在未经授权的情况下攻击系统。 摘要 在 WooCommerce 的 MyRewards（WooRewards） 插件（版本 mSource-write$data; 业务影响 经济损失： 通过操纵“订单金额”积分倍数，攻击者可生成无限奖励积分，并将其兑换为高价值折扣券或免费商品，绕过电商支付网关。 权限提升： 普通客户（订阅者）可执行插件管理操作。 数据完整性受损：...
EUVD-2026-75793
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control...
CVE-2020-9332
CVE-2020-9332 描述 FabulaTech 的“USB for Remote Desktop”和“USB over Network”中存在一个有漏洞的总线驱动程序，允许低权限用户添加一个完全受控的软件 USB 设备，这可能在常见情况下被攻击者利用以提升权限 漏洞类型 不正确的访问控制 产品供应商 FabulaTech 受影响的产品代码库 USB for Remote Desktop USB over Network 攻击类型 本地 权限提升影响 true CVE 其他影响 添加由非特权用户完全控制的受信任软件 USB HID 设备 发现者 来自 SentinelOne 的...
