4485 matches found
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: cachefiles: The exposure of the anonymous file descriptor is deferred until after copytouser succeeds. After installing the anonymous file descriptor, we can now see it in userland and close it. However, at this point we may not...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Anonymous sets are never used with a timeout flag; therefore, this behavior is disallowed. An exception to this rule applies for NFTSETEVAL, to ensure that legacy metering mechanisms continue to work properly...
Quest KACE System Management Appliance 8.0.318 - Remote Code Execution
The '/common/downloadagentinstaller.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system. id: CVE-2018-11138 info: name: Quest KACE System Management Appliance 8.0.318 - Remote Code Executi...
PT-2026-115021
Name of the Vulnerable Software and Affected Versions Lychee versions prior to 7.6.1 Description An issue exists when the photos star visibility setting is configured as anonymous. An unauthenticated attacker who can guess photo identifiers can use the 'POST /api/v2/Photo::highlight' endpoint to...
CVE-2026-78433
Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a publi...
CVE-2026-110466
Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypass anonymous grading restrictions and obtain anonymous student information...
EUVD-2026-100872
Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypass anonymous grading restrictions and obtain anonymous student information...
CVE-2026-110466 WisdomGarden｜Tronclass - Sensitive Data Exposure
Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypass anonymous grading restrictions and obtain anonymous student information...
CVE-2026-110466
The Tronclass software, developed by WisdomGarden , contains a Sensitive Data Exposure vulnerability (CWE-497). Authenticated remote attackers can bypass anonymous grading restrictions to obtain anonymous student information . No specific patch versions, workarounds, or evidence of in-the-wild ex...
PT-2026-113677
Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypass anonymous grading restrictions and obtain anonymous student information...
EUVD-2026-96552
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController release handler that allows any authenticated user to publish or unpublish other users' AI applications. Low-privileged attackers can send POST requests to /airag/app/release to obtain share tokens...
awesome-jenkins-rce-2019
awesome-jenkins-rce-2019 Non c'è una RCE pre-autenticazione in Jenkins dal maggio 2017, ma questa è quella giusta! Combina CVE-2018-1000861, CVE-2019-1003005 e CVE-2019-1003029 per un'esecuzione remota di codice pre-autenticazione più affidabile ed elegante! Elenco delle versioni interessate...
GO-2026-6632 SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route in github.com/siyuan-note/siyuan/kernel
SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route in github.com/siyuan-note/siyuan/kernel...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: mm/khugepaged: fixed -anonvma race condition If an -anonvma is attached to the VMA, the collapseandfreepmd function requires it to be locked. Page table traversal is allowed under either the mmap lock, the anonvma lock if the...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: fs: export anoninodemakesecureinode and fix the issue with secretmem LSM bypass. The anoninodemakesecureinode function was exported to allow KVM guestmemfd to create anonymous inodes with proper security context. This replaces...
EUVD-2026-60585
SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers...
SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers
Same CWE-862 family, found via an automated bulk sweep of every /api/block/ handler in kernel/api/block.go for the presence of any access-check reference IsReadOnlyRoleContext, checkBlockPublishAccess, GetPublishAccess anywhere in the function body. 17 of 28 candidate endpoints have none...
GHSA-J4PH-9XWF-WCJ4 SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering
Summary /api/attr/getBookmarkLabels is registered with CheckAuth only and applies no filtering of any kind. It runs a scan of the entire blocks table and returns the distinct set of every bookmark label in the workspace. An anonymous reader in publish mode receives the author's complete bookmark...