CVE-2026-22014-GraphQL-Persisted-Queries-Injection-via-ID-Manipulation

CVE-2026-22014 – ID 조작을 통한 GraphQL Persisted Queries 인젝션 프로그램 코드Node.js // graphqlpersisted.js - Accepts persisted query IDs const express = require'express'; const graphqlHTTP = require'express-graphql'; const queries = "abc": "query user name " ; app.post'/graphql', graphqlHTTP schema: schema,...

CVE-2026-21020-Protobuf-Message-Parsing-Polymorphic-Deserialization-Vulnerability

CVE-2026-21020 – Protobuf 메시지 파싱 다형성 역직렬화 취약점 프로그램 코드 Python with protobuf protovuln.py - Insecure handling of Any type import addressbookpb2 Example protobuf Simulated deserialization that trusts an injected typeurl from google.protobuf import anypb2 anymsg = anypb2.Any anymsg.typeurl =...

flowise-arbitrary-file-read-getFileFromStorage

Flowise 인증 우회 임의 파일 읽기 getFileFromStorage — 제안된 신규 CVE CVE-2025-71338쓰기write 싱크과 별개의 취약점 입니다. 이는 Flowise 문서 저장소 로더 "리하이드레이션rehydrate" 경로에서 인증 없이 가능한 임의 파일 읽기 로, 1.7.1 – 2.2.3 에 영향이 있으며 2.2.4 에서 수정되었습니다. /root/.flowise/encryption.key를 읽으면 저장된 모든 공급자 자격 증명을 해독하는 키를 얻을 수 있습니다 → 전체 자격 증명 탈취. 목차 파일| 용...

CVE-2026-13714

CVE-2026-13714 Realtyna Organic IDX 플러그인 + WPL Real Estate │ │ ├─ privatekey = │ │ ├─ cmd = setproperty │ │ └─ file = imageNxabc.php │ │─────────────────────────────────────────►│ │...

IoRingReadWritePrimitive

IoRingReadWritePrimitive Windows 11 22H2+에서 임의 커널 쓰기/증가를 완전한 읽기/쓰기 프리미티브로 전환하는 사후 익스플로잇 기법 이 PoC는 HackSysExtremeVulnerableDriver를 사용합니다. PoC는 main에서 함수로 전달되는 플래그를 통해 임의 쓰기와 임의 증가를 모두 지원합니다. 임의 증가를 위해서는 최신 HEVD 드라이버를 소스에서 컴파일하세요. 분석 문서:...

security-research

보안 연구 개인 보안 연구와 관련된 파일 모음입니다. 추가 콘텐츠는 제 블로그 https://blog.mirch.io에 게시됩니다. 도구 도구| 설명 ---|--- openssldircheck| OpenSSL 라이브러리의 OPENSSLDIR 빌드 매개변수에서 사용하는 잠재적으로 안전하지 않은 경로를 확인하는 Windows 유틸리티 ssscache2john| SSSD LDAP 캐시 파일을 John The Ripper 형식으로 변환 DumpTompcatSessions| JMX를 사용하여 Tomcat 세션 덤프 취약점...

marshalsec

Java Unmarshaller Security - 데이터를 코드 실행으로 바꾸기 Log4Shell/CVE-2021-44228 때문에 여기에 오셨다면, 공격 벡터와 영향을 받는 Java 런타임 버전에 대해 읽어보시기 바랍니다: https://mbechler.github.io/2021/12/10/PSALog4ShellJNDIInjection/ 논문 Chris Frohoff와 Garbriel Lawrence가 Java 객체 역직렬화 취약점에 대한 연구를 발표한 지 2년 이상이 지났습니다. 그 연구는 궁극적으로 Java 역사상 가장...

CVE-2026-106177

A kernel buffer overflow vulnerability in HP Sure Click versions prior to 4.4.33 may allow local privilege escalation or arbitrary code execution. HP has released version 4.4.33 to address this vulnerability...

kernel: svcrdma: Reject inline replies that overflow the pull-up buffer

A flaw was found in the Linux kernel's svcrdma component, which handles network communication using Remote Direct Memory Access RDMA. A remote attacker can send a specially crafted network reply that is larger than expected. This can cause the system to write data beyond the intended memory area,...

kernel: nfsd: initialize copy-notify stateid before publishing it

A flaw was found in the nfsd component of the Linux kernel. A use-after-free vulnerability exists due to improper initialization of the copy-notify state ID before its publication. A remote attacker could exploit this by sending a crafted OFFLOADCANCEL operation, leading to a race condition that...

qu1ckr00t

qu1ckr00t Android 커널 임의 읽기/쓰기CVE-2019-2215의 위력을 보여주는 PoC 애플리케이션입니다. Writeup: https://hernan.de/blog/2019/10/15/tailoring-cve-2019-2215-to-achieve-root/ Qu1ckR00t는 개념 증명PROOF OF CONCEPT용입니다. 소중한 사용자 데이터가 있는 개인 기기에서 사용해서는 안 됩니다. Pixel 2에서만 테스트되었습니다. 다른 기기/커널에서 실행하면 충돌이나 데이터 손실이 발생할 수 있습니다. 메시지가...

kernel: svcrdma: Reject inline replies that overflow the pull-up buffer

A flaw was found in the Linux kernel's svcrdma component, which handles network communication using Remote Direct Memory Access RDMA. A remote attacker can send a specially crafted network reply that is larger than expected. This can cause the system to write data beyond the intended memory area,...

kernel: nfsd: initialize copy-notify stateid before publishing it

A flaw was found in the nfsd component of the Linux kernel. A use-after-free vulnerability exists due to improper initialization of the copy-notify state ID before its publication. A remote attacker could exploit this by sending a crafted OFFLOADCANCEL operation, leading to a race condition that...

Security Bulletin: Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection

Summary Multiple vulnerabilities have been addressed in the Sniffer component as part of IBM Guardium Data Protection Vulnerability Details CVEID:CVE-2026-75875 DESCRIPTION: IBM Guardium Data Protection could allow a remote attacker to execute arbitrary code due to path traversal. CWE:CWE-22:...

Important: Red Hat Security Advisory: postgresql:12 security update

An update for the postgresql:12 module is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A...

postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump

A vulnerability in PostgreSQL allows a malicious origin-server superuser to achieve client-side arbitrary code execution during a database restore. By injecting untrusted data into a pgdump export, the attacker can exploit the input expansion of the psql \restrict meta-command. When a victim...

Important: Red Hat Security Advisory: postgresql:12 security update

An update for the postgresql:12 module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump

A vulnerability in PostgreSQL allows a malicious origin-server superuser to achieve client-side arbitrary code execution during a database restore. By injecting untrusted data into a pgdump export, the attacker can exploit the input expansion of the psql \restrict meta-command. When a victim...

Important: Red Hat Security Advisory: postgresql:12 security update

An update for the postgresql:12 module is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A...

postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump

A vulnerability in PostgreSQL allows a malicious origin-server superuser to achieve client-side arbitrary code execution during a database restore. By injecting untrusted data into a pgdump export, the attacker can exploit the input expansion of the psql \restrict meta-command. When a victim...