CVE-2026-55847

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through AnsiToHtml without HTML escaping and wraps...

CVE-2026-55847 Allure: Stored XSS via unescaped ANSI helper in Allure report status message/trace rendering

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through AnsiToHtml without HTML escaping and wraps...

EUVD-2026-77688

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through AnsiToHtml without HTML escaping and wraps...

CVE-2026-55847

Allure 2 (a multi-language test reporting tool) is vulnerable to stored XSS in the ansi.js Handlebars helper within allure-generator. Prior to 2.39.0 , attacker-controlled statusMessage and statusTrace values (sourced from JUnit XML, TRX, xUnit, xctest, or Allure1/2 plugins) are passed through th...

wolfssl

Biblioteca wolfSSL SSL/TLS embebida La biblioteca SSL embebida wolfSSL anteriormente CyaSSL es una biblioteca SSL/TLS ligera escrita en C ANSI y orientada a entornos embebidos, RTOS y con recursos limitados, principalmente por su pequeño tamaño, velocidad y conjunto de características. También se...

CVE-2021-45067

CVE-2021-45067 此漏洞是越界读取，因为将ANSI字符串视为Unicode，可能被利用从沙盒化的Adobe Reader进程中泄露敏感信息。 博客 Adobe Reader - XFA - ANSI - Unicode 混淆信息泄漏 公告 CVE-2021-45067 演示...

CVE-2026-48813-POC

Flawfinder-ANSI-Exploit-POC 在 Flawfinder 2.0.19 版本中，解析可能恶意的文件名时未进行文件名清理。已知受影响的终端基于 libvte，以下示例展示了一个 mate-terminal。 此漏洞已于 2026年5月17日 由 David Wheeler 和我在 2.0.20 版本中修复。 本仓库包含一个示例 POC bash 脚本以及关于该漏洞工作原理的一些信息。 漏洞利用演练 在示例目录中，可以包含任意数量的文件，如下所示： 这些文件都包含相同的 C 代码： root@kitploit: include void fchar s char...

CVE-2026-90773

procs through 0.14.12 is vulnerable to terminal escape sequence injection via its Command column. The tool fails to sanitize ANSI or OSC escape sequences embedded in process command-line arguments before rendering them, allowing a local attacker with low privileges to craft a process whose comman...

CVE-2026-90773 procs through 0.14.12 Terminal Escape Sequence Injection via Command

procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute processes with malicious ANSI or OSC escape sequences in their command line arguments, which are written unmodified to other users' terminals...

EUVD-2026-76994

procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute processes with malicious ANSI or OSC escape sequences in their command line arguments, which are written unmodified to other users' terminals...

Linux Distros Unpatched Vulnerability : CVE-2026-90773

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute...

My-Presentation-Slides

Mis diapositivas de presentaciones Diapositivas de presentaciones públicas de Orange Tsai. Puedes encontrarme en: Blog: https://blog.orange.tw/ Correo: [email protected] Twitter: @orange8361 2024 WorstFit: Revelando transformadores ocultos en Windows ANSI! Black Hat Europe DEVCORE CONF 2025...

CVE-2026-87985

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary code on the user's system without approval...

CVE-2026-87985

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary code on the user's system without approval...

EUVD-2026-76120

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary code on the user's system without approval...

CVE-2026-87985

Mistral Vibe contains an arbitrary code execution vulnerability caused by ANSI-C quoted arguments that bypass command permission checks. Because these arguments are not properly inspected, an attacker can craft an allowlisted command to execute arbitrary code on the user's system without requirin...

PT-2026-89887

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary code on the user's system without approval...

CVE-2019-12735

CVE-2019-12735 该CVE在neovim 0.3.6和vim 8.1.1365之后被修复。 POC root@kitploit: vim demo1.txt 远程shell 1. 创建恶意文本文件： root@kitploit: gcc makedemo3.c -o makedemo3 ./makedemo3 2. 在另一个会话中构建客户端： root@kitploit: nc -vlp 9999 3. 打开恶意文件： root@kitploit: vim demo3.txt 之后，您可以在会话中执行任意Linux命令。 参考 A POC demo on github...

PoC-CVE-2020-9715

CVE-2020-9715 EDR 验证 PoC Adobe Acrobat Reader DC 的 EScript.api ESObject 缓存中存在释放后使用漏洞。仅限授权红队进行EDR测试。 漏洞 Adobe Acrobat Reader DC = 2020.009.20063。EScript 引擎缓存数据 ESObject 时，使用的键保留了原始编码（ANSI 或 Unicode）。删除操作始终构造 Unicode 键，因此 ANSI 命名的条目永远不会从缓存中清除。在 GC 释放底层对象后，过期的缓存条目变成悬空指针。 PoC 的功能 1. 在 PDF 中嵌入一个具有 ANS...

cve-2024-52005-poc

CVE-2024-52005: Inyección de Secuencias de Escape ANSI en Git Resumen Este repositorio contiene una Prueba de Concepto PoC que demuestra CVE-2024-52005, una vulnerabilidad en Git que permite la inyección de secuencias de escape ANSI a través del canal sideband durante operaciones de Git...