CVE-2024-6778-POC

CVE-2024-5836 / CVE-2024-6778 Este repositorio contiene exploits de prueba de concepto para CVE-2024-5836 y CVE-2024-6778, que son vulnerabilidades en el navegador web Chromium que permitían un escape de la sandbox desde una extensión del navegador. Para ejecutarlos, debes estar en una versión de...

cve-2024-4367-poc

CVE-2024-4367 POC para PDF.js PoC para la vulnerabilidad CVE-2024-4367 de PDF.js: el script pdf-modify.py se puede utilizar para modificar tus PDFs e inyectar payloads. Uso 1. Asegúrate de que CVE-2024-4367-POC-base-placeholder.pdf esté en el directorio de trabajo. 2. Descomenta/modifica la...

CVE-2024-4367

CVE-2024-4367 POC Usage root@kitploit: python poc.py mal.pdf "alert'0xr2r'" References CVE-2024-4367: Arbitrary JS Execution in PDF.js PDF.js POC scaner templates...

WEAPONIZING-CVE-2024-4367

WEAPONIZING-CVE-2024-4367 CVE-2024-4367 es una vulnerabilidad crítica CVSS 9.8 en PDF.js, que permite la ejecución arbitraria de código JavaScript debido a comprobaciones de tipo insuficientes en el objeto FontMatrix dentro de archivos PDF. Asistente de Explotación CVE-2024-4367: Guía de Usuario...

Linux Distros Unpatched Vulnerability : CVE-2026-88060

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, a...

EUVD-2026-74074

Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The...

Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes

Summary Appium's base-driver mounts the built-in /test/guinea-pig, /test/guinea-pig-scrollable and /test/guinea-pig-app-banner routes unconditionally on every server. The handler reflects the throwError query param, the comments POST field, and the User-Agent request header into the returned HTML...

Important: Red Hat Security Advisory: webkit2gtk3 security update

An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

EUVD-2020-28933

Malware in sbrugna...

CVE-2024-49505

Summary: CVE-2024-49505 is a reflected-cross-site scripting (XSS) vulnerability in openSUSE Tumbleweed MirrorCache. The issue arises from improper input neutralization in the web page generation process, specifically affecting the REGEX and P parameters. Affected versions are MirrorCache before 1...

CVE-2024-49505 XSS vulnerability found in OpenSuse MirrorCache

A Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in openSUSE Tumbleweed MirrorCache allows the execution of arbitrary JS via reflected XSS in the REGEX and P parameters. This issue affects MirrorCache before 1.083...

CVE-2022-23861

Multiple Stored Cross-Site Scripting vulnerabilities were discovered in Y Soft SAFEQ 6 Build 53. Multiple fields in the YSoft SafeQ web application can be used to inject malicious inputs that, due to a lack of output sanitization, result in the execution of arbitrary JS code. These fields can be...

CVE-2022-23861

CVE-2022-23861 affects YSoft SAFEQ 6 Build 53. The vulnerability is Multiple Stored Cross-Site Scripting (XSS) in the SafeQ web interface, caused by lack of output sanitization in multiple input fields, allowing arbitrary JavaScript execution for users accessing the web UI. Connected sources corr...

CVE-2022-23861

Multiple Stored Cross-Site Scripting vulnerabilities were discovered in Y Soft SAFEQ 6 Build 53. Multiple fields in the YSoft SafeQ web application can be used to inject malicious inputs that, due to a lack of output sanitization, result in the execution of arbitrary JS code. These fields can be...

CVE-2022-23861

Multiple Stored Cross-Site Scripting vulnerabilities were discovered in Y Soft SAFEQ 6 Build 53. Multiple fields in the YSoft SafeQ web application can be used to inject malicious inputs that, due to a lack of output sanitization, result in the execution of arbitrary JS code. These fields can be...

Amazon Linux 2 : python-lxml (ALAS-2024-2620)

The version of python-lxml installed on the remote host is prior to 3.2.1-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2620 advisory. An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and...

CVE-2024-29831

CVE-2024-29831 relates to an improper input validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed JavaScript to be executed on the server, potentially enabling remote code execution. Affected: DolphinScheduler; remediation guidance consistentl...

Medium: python-lxml

Issue Overview: An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this...

Exploit for Improper Check for Unusual or Exceptional Conditions in Mozilla Firefox

CVE-2024-4367 POC Usage bash python poc.py malicious.p...

CVE-2024-23320 Apache DolphinScheduler: Arbitrary js execution as root for authenticated users

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it. This...