PerkinElmer ProcessPlus <= 1.11.6507.0 - Local File Inclusion

Files on the Windows system are accessible without authentication to external parties due to a local file inclusion in PerkinElmer ProcessPlus.This issue affects ProcessPlus through 1.11.6507.0. id: CVE-2024-6911 info: name: PerkinElmer ProcessPlus = 1.11.6507.0 - Local File Inclusion author:...

DevGuide

OWASP Foundation Developer Guide The Developer Guide is one of the original documents from OWASP and so has a long history. The original DevGuide repository has many of the previous versions going back to the very first version 1.0 release from 2002. This is the content for the Developer Guide...

shepard

SHEPARD BITS This is a persistance tool using Windows Background Intelligent Transfer Service BITS. Functionality File Download, File Exfiltration, File Download + Persistent Execution Usage Run shepard.exe as Administrator with the following command line arguments: -d : regular file download to ...

s3_objects_check

S3 Objects Check Description Whitebox evaluation of effective S3 object permissions, in order to identify publicly accessible objects. Allows identifying publicly accessible objects, as well as objects accessible for AuthenticatedUsers by using a secondary profile. A number of tools exist which...

poro

poro Description Scan for publicly accessible assets on your AWS environment Services covered by this tool: AWS ELB API Gateway S3 Buckets RDS Databases EC2 instances Redshift Databases Poro also check if a tag you specify is applied to identified public resources using --tag-key and --tag-value...

openjdk: Enhance diagnostic sessions (Oracle CPU 2026-10)

A flaw was found in OpenJDK's Serviceability component. An unauthenticated attacker with local access to the host system can exploit this vulnerability with user interaction, such as by supplying crafted input to Serviceability application programming interfaces APIs. A successful attack can resu...

CheatSheetHost

CheatSheetHost A lightweight, content-driven web server for hosting interactive cheatsheets and reference materials. Perfect for CTF Capture The Flag challenges, reverse engineering, and technical documentation. This is best used in labs where you want to limit or forgo external traffic while sti...

CVE-2026-118494

A flaw was found in JReviews. The extension stores cached configuration settings, including system secrets and third-party application programming interface API keys, in a web-accessible directory without proper access controls. An unauthenticated remote attacker who determines the cache file pat...

CVE-2026-111464

The WP Fastest Cache plugin for WordPress (versions up to and including 1.5.3 ) is vulnerable to Sensitive Information Exposure . The plugin fails to honor no-store/no-cache headers, the wp-activate-* cookie, or the WP_INSTALLING state when caching the Core wp-activate.php response. This results ...

CVE-2026-111464 WP Fastest Cache <= 1.5.3 - Unauthenticated Sensitive Information Exposure via Cached wp-activate.php Response

The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.3. The plugin caches the response of Core’s wp-activate.php without honoring its no-store/no-cache headers, the wp-activate- cookie, or the WPINSTALLING state, writi...

CVE-2026-105606

Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission for...

EUVD-2026-115367

Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission for...

CVE-2026-105606 Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8

Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission for...

CVE-2026-105606

The Joomla Extension - joomlaboat.com (versions prior to 3.7.8 ) is vulnerable to an unauthenticated arbitrary file upload in the Custom Tables component. An attacker can upload a polyglot file with a controlled extension to a web-accessible tmp directory via a public submission form, as the stor...

CVE-2026-105606 Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8

Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission for...

PT-2026-135637

Name of the Vulnerable Software and Affected Versions Custom Tables versions prior to 3.7.8 Description An unauthenticated attacker can upload a polyglot file with a controlled extension to the web-accessible tmp directory of a Joomla site that exposes a public Custom Tables submission form. A...

CVE-2026-105606: joomlaboat.com Custom Tables extension for Joomla: Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 - An unauthenticated…

Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission for...

Files or Directories Accessible to External Parties

Overview org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing an...

CLEANSTART-2024-TA68556 Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy

CVE-2022-22761 affects multiple packages. Web-accessible extension pages pages with a moz-extension:// scheme were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy. See references for individual vulnerability details...

Jupyter Server authorization issue vulnerability

Versions 2.0.0 through 2.6.0 of Jupyter Server contain an authorization issue vulnerability. This arises because after enabling GatewayClient.url, WebSocketChannelsHandler fails to perform authorization checks on calls to execute on kernels resources via authorizer.isauthorized.... As a result,...