CVE-2020-12124

Anatomie d'une Exploitation IoT, de la Pratique au RCE originellement sur https://www.klogixsecurity.com/scorpion-labs-blog/anatomy-of-an-iot-exploit-from-hands-on-to-rce par David E. Baker, publié le 1er juin 2023 Avant-propos Cette étude concerne le firmware du routeur Gigabit Wavlink...

cve-2023-22527

Exécution de code arbitraire dans la mémoire de Confluence CVE-2023-22527 est une vulnérabilité largement connue affectant Atlassian Confluence. La plupart des exploits pour cette vulnérabilité utilisent freemarker.template.utility.Execute pour exécuter une commande système, mais ils peuvent fair...

CVE-2026-103628

An out of bounds write flaw was found in the WebGL component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/549995090...

CVE-2026-35585-poc

CVE-2026-35585: PoC d'injection de commandes OS dans File Browser English version Aperçu Ce dépôt est une preuve de concept PoC de la vulnérabilité critique d'injection de commandes OS CVE-2026-35585 découverte dans File Browser versions 2.0.0 à 2.33.1. Cette vulnérabilité se trouve dans la...

CVE-2016-2098

CVE-2016-2098 Action Pack dans Ruby on Rails avant les versions 3.2.22.2, 4.x avant 4.1.14.2 et 4.2.x avant 4.2.5.2 permet à des attaquants distants d'exécuter du code Ruby arbitraire en exploitant l'utilisation non restreinte de la méthode render par une application. Resources...

CVE-2020-7961-payloads

CVE-2020-7961-payloads Désérialisation de données non fiables dans Liferay Portal antérieur à 7.2.1 CE GA2 permet à des attaquants distants d'exécuter du code arbitraire via les services web JSON JSONWS Étape 1 Écrivez votre payload dans LifExp.java Étape 2 Compilez-le avec javac Étape 3 Configur...

Adobe ColdFusion - Deserialization of Untrusted Data

Adobe ColdFusion versions 2018u17 and earlier, 2021u7 and earlier and 2023u1 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. id: CVE-2023-38203 info: name:...

CVE-2022-24818

CVE-2022-24818 : Désérialisation Java via des recherches JNDI non contrôlées dans GeoServer et GeoTools La bibliothèque GeoTools possède un certain nombre de sources de données capables d'effectuer des recherches JNDI non contrôlées, lesquelles peuvent à leur tour être utilisées pour effectuer un...

CVE-2026-105080

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloadedrecipe file...

CVE-2026-105080

In ConvertX versions prior to 0.19.0 , the converters/calibre.ts component fails to block recipe files . Instead, it passes these files to the ebook-convert program from Calibre. This vulnerability allows for the execution of arbitrary code contained within .recipe or .downloaded_recipe files. Re...

EUVD-2026-91836

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of...

CVE-2024-41817-poc

Exécution de code arbitraire dans ImageMagick CVE-2024-41817 Preuve de concept d'exploit pour ImageMagick versions = 9.4.0 Paquets Python : paramiko Installation git clone https://github.com/Dxsk/CVE-2024-41817-poc/ cd CVE-2024-41817-poc pip install -r requirements.txt Utilisation Détection...

Linux Distros Unpatched Vulnerability : CVE-2026-103631

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Debian dla-4815 : freecad - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4815 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4815-1 [email protected]...

Debian dla-4816 : libpcre2-16-0 - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4816 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4816-1 [email protected] https://www.debian.org/lts/security/...

Linux Distros Unpatched Vulnerability : CVE-2026-103625

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

CVE-2024-3094-check

Outils de vérification de la vulnérabilité CVE-2024-3094 Cette vulnérabilité permet à un attaquant de se connecter au serveur et d'exécuter du code arbitraire sans passer par l'authentification SSH. Pour plus de détails, veuillez consulter : https://www.openwall.com/lists/oss-security/2024/03/29/...

CVE-2026-84411

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of...

CVE-2026-84411

The web management service in MikroTik RouterOS versions prior to 7.24 is vulnerable to an integer underflow in its HTTP request body handling. This flaw is reachable before authentication , allowing an unauthenticated network attacker to achieve arbitrary code execution as root or cause a denial...

CVE-2026-84411 MikroTik RouterOS Integer Underflow

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of...