CVE-2024-6778-POC

CVE-2024-5836 / CVE-2024-6778 此仓库包含了针对 CVE-2024-5836 和 CVE-2024-6778 的概念验证利用代码，这些是Chromium网页浏览器中的漏洞，允许从浏览器扩展中进行沙箱逃逸。要运行这些，你必须使用早于 126.0.6478.54 的 Chromium 版本。 详情文章：https://ading.dev/blog/posts/chromesandboxescape.html 错误报告：https://issues.chromium.org/issues/338248595 CVE-2024-5386 和 CVE-2024-6778...

cve-2024-4367-poc

CVE-2024-4367 的 PDF.js POC PDF.js 的 CVE-2024-4367 漏洞的 POC——pdf-modify.py 脚本可用于修改你的 PDF 并注入载荷。 使用方法 1. 确保 CVE-2024-4367-POC-base-placeholder.pdf 位于工作目录中。 2. 取消注释/修改 pdf-modify.py 中的 payloadnew 变量。 3. 运行它：python pdf-modify.py，无需任何参数。 4. 你会在本地目录中看到一个新的 PDF，其文件名带有时间戳后缀。 相关参考...

CVE-2024-4367

CVE-2024-4367 POC 使い方 root@kitploit: python poc.py mal.pdf "alert'0xr2r'" 参照 CVE-2024-4367: Arbitrary JS Execution in PDF.js PDF.js POC スキャナー templates...

WEAPONIZING-CVE-2024-4367

WEAPONIZING-CVE-2024-4367 CVE-2024-4367 是 PDF.js 中的一个严重漏洞（CVSS 9.8），由于对 PDF 文件中的 FontMatrix 对象类型检查不足，允许执行任意 JavaScript 代码。 CVE-2024-4367 漏洞利用向导：用户指南 CVE 标识符| CVE-2024-4367 ---|--- 严重性| 严重（CVSS 评分：9.8） 漏洞类型| PDF.js 中因对 FontMatrix 对象类型检查不足而导致的任意 JavaScript 代码执行 利用方式| 恶意构造的 PDF 文件可在受害者浏览器中执行...

Important: Red Hat Security Advisory: webkit2gtk3 security update

An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

EUVD-2020-28933

Malware in sbrugna...

CVE-2024-49505

Summary: CVE-2024-49505 is a reflected-cross-site scripting (XSS) vulnerability in openSUSE Tumbleweed MirrorCache. The issue arises from improper input neutralization in the web page generation process, specifically affecting the REGEX and P parameters. Affected versions are MirrorCache before 1...

CVE-2024-49505 XSS vulnerability found in OpenSuse MirrorCache

A Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in openSUSE Tumbleweed MirrorCache allows the execution of arbitrary JS via reflected XSS in the REGEX and P parameters. This issue affects MirrorCache before 1.083...

CVE-2022-23861

Multiple Stored Cross-Site Scripting vulnerabilities were discovered in Y Soft SAFEQ 6 Build 53. Multiple fields in the YSoft SafeQ web application can be used to inject malicious inputs that, due to a lack of output sanitization, result in the execution of arbitrary JS code. These fields can be...

CVE-2022-23861

CVE-2022-23861 affects YSoft SAFEQ 6 Build 53. The vulnerability is Multiple Stored Cross-Site Scripting (XSS) in the SafeQ web interface, caused by lack of output sanitization in multiple input fields, allowing arbitrary JavaScript execution for users accessing the web UI. Connected sources corr...

CVE-2022-23861

Multiple Stored Cross-Site Scripting vulnerabilities were discovered in Y Soft SAFEQ 6 Build 53. Multiple fields in the YSoft SafeQ web application can be used to inject malicious inputs that, due to a lack of output sanitization, result in the execution of arbitrary JS code. These fields can be...

CVE-2022-23861

Multiple Stored Cross-Site Scripting vulnerabilities were discovered in Y Soft SAFEQ 6 Build 53. Multiple fields in the YSoft SafeQ web application can be used to inject malicious inputs that, due to a lack of output sanitization, result in the execution of arbitrary JS code. These fields can be...

Amazon Linux 2 : python-lxml (ALAS-2024-2620)

The version of python-lxml installed on the remote host is prior to 3.2.1-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2620 advisory. An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and...

CVE-2024-29831

CVE-2024-29831 relates to an improper input validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed JavaScript to be executed on the server, potentially enabling remote code execution. Affected: DolphinScheduler; remediation guidance consistentl...

Medium: python-lxml

Issue Overview: An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this...

Exploit for Improper Check for Unusual or Exceptional Conditions in Mozilla Firefox

CVE-2024-4367 POC Usage bash python poc.py malicious.p...

CVE-2024-23320 Apache DolphinScheduler: Arbitrary js execution as root for authenticated users

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it. This...

CVE-2024-23320 Apache DolphinScheduler: Arbitrary js execution as root for authenticated users

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it. This...

Apache DolphinScheduler: Arbitrary js execute as root for authenticated users

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to version 3.1.9, which fixes the issue...

CVE-2023-49299 Apache DolphinScheduler: Arbitrary js execute as root for authenticated users

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to version 3.1.9, which fixes the issue...