Malicious code in express-enhanced (npm)

[email protected] impersonates express it copies express's package metadata, including the description "Fast, unopinionated, minimalist web framework" and author TJ Holowaychuk and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: curl -L...

MAL-2026-17489 Malicious code in express-enhanced (npm)

[email protected] impersonates express it copies express's package metadata, including the description "Fast, unopinionated, minimalist web framework" and author TJ Holowaychuk and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: curl -L...

cve-2021-25646

Apache Druid Ejecución Remota de Código Resumen de la vulnerabilidad Apache Druid publicó una actualización de seguridad que informa sobre una vulnerabilidad de ejecución remota de código, con identificador CVE-2021-25646. Debido a que Apache Druid carece de autenticación por defecto, un atacante...

CVE-2020-12124

Anatomía de un Exploit de IoT, del Práctico al RCE originalmente en https://www.klogixsecurity.com/scorpion-labs-blog/anatomy-of-an-iot-exploit-from-hands-on-to-rce por David E. Baker, publicado el 1 de junio de 2023 Prefacio Este estudio trata sobre el firmware del router Gigabit inalámbrico...

cve-2023-22527

Ejecución de Código Arbitrario en la Memoria de Confluence CVE-2023-22527 es una vulnerabilidad ampliamente conocida que afecta a Atlassian Confluence. La mayoría de los exploits para esta vulnerabilidad utilizan freemarker.template.utility.Execute para ejecutar un comando del sistema operativo,...

CVE-2026-103628

An out of bounds write flaw was found in the WebGL component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/549995090...

CVE-2026-35585-poc

CVE-2026-35585: File Browser OS Command Injection PoC Description This repository contains a Proof of Concept PoC for CVE-2026-35585 , a critical OS Command Injection vulnerability discovered in File Browser versions 2.0.0 through 2.33.1. The vulnerability exists in the "Custom Command Hooks"...

CVE-2016-2098

CVE-2016-2098 Action Pack en Ruby on Rails anterior a 3.2.22.2, 4.x anterior a 4.1.14.2 y 4.2.x anterior a 4.2.5.2 permite a atacantes remotos ejecutar código Ruby arbitrario aprovechando el uso sin restricciones del método render por parte de una aplicación. Recursos...

CVE-2020-7961-payloads

CVE-2020-7961-payloads Deserialización de datos no confiables en Liferay Portal anterior a 7.2.1 CE GA2 permite a atacantes remotos ejecutar código arbitrario a través de servicios web JSON JSONWS Paso 1 Escribe tu payload en LifExp.java Paso 2 Compílalo con javac Paso 3 Configura tu servidor de...

Adobe ColdFusion - Deserialization of Untrusted Data

Adobe ColdFusion versions 2018u17 and earlier, 2021u7 and earlier and 2023u1 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. id: CVE-2023-38203 info: name:...

CVE-2022-24818

CVE-2022-24818: Deserialización de Java mediante búsquedas JNDI no verificadas en GeoServer y GeoTools La biblioteca GeoTools tiene una serie de fuentes de datos que pueden realizar búsquedas JNDI no verificadas, que a su vez pueden utilizarse para llevar a cabo la deserialización de clases y...

CVE-2026-105080

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloadedrecipe file...

CVE-2026-105080

In ConvertX versions prior to 0.19.0 , the converters/calibre.ts component fails to block recipe files . Instead, it passes these files to the ebook-convert program from Calibre. This vulnerability allows for the execution of arbitrary code contained within .recipe or .downloaded_recipe files. Re...

EUVD-2026-91836

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of...

CVE-2024-41817-poc

ImageMagick Ejecución Arbitraria de Código CVE-2024-41817 Exploit de Prueba de Concepto para versiones de ImageMagick = 9.4.0 Paquetes de Python: paramiko Instalación git clone https://github.com/Dxsk/CVE-2024-41817-poc/ cd CVE-2024-41817-poc pip install -r requirements.txt Uso Detección automáti...

Linux Distros Unpatched Vulnerability : CVE-2026-103625

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Debian dla-4816 : libpcre2-16-0 - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4816 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4816-1 [email protected] https://www.debian.org/lts/security/...

Debian dla-4815 : freecad - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4815 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4815-1 [email protected]...

Linux Distros Unpatched Vulnerability : CVE-2026-103631

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

CVE-2024-3094-check

Herramientas de comprobación de CVE-2024-3094 Esta vulnerabilidad permite a un atacante iniciar sesión en el servidor y ejecutar código arbitrario sin pasar la autenticación SSH. Para más detalles, consulta: https://www.openwall.com/lists/oss-security/2024/03/29/4 uso curl -fsSL...