55 matches found
FACT
Forensic Artefact Collection Tool Overview FACT is a tool to collect, process and visualise forensic data from clusters of machines running in the cloud or on-premise. Deployment For a basic single-node deployment, we recommend using Docker and Docker Compose. First, read docker-compose.yaml for...
EUVD-2026-60546
Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated...
CVE-2026-42162
Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated...
PT-2026-76879
Name of the Vulnerable Software and Affected Versions Mahara versions prior to 25.04.5 Mahara versions prior to 26.04.0 Description An issue exists where artefacts may become accessible to unauthorized users if the file path to an artefact within a page is manipulated. Recommendations Update to...
CVE-2026-42162
Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated...
CVE-2026-42162
Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated...
CVE-2026-42162
Mahara versions prior to 25.04.5 and 26.04.0 are vulnerable to an issue where artefacts may become accessible to unauthorized users. This occurs under certain circumstances when the file path to an artefact within a page is manipulated, resulting in an improper limitation of a pathname to a restr...
CVE-2026-42162: Improper Limitation of a Pathname to a Restricted Directory
Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated...
CVE-2026-18749
The type=track branch authorises on ismycasetattach.case only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has or is sent its uuid — leaks not-yet-released coordinator material to...
CVE-2026-18749 CVE-2026-18749
The type=track branch authorises on ismycasetattach.case only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has or is sent its uuid — leaks not-yet-released coordinator material to...
CVE-2026-18749 CVE-2026-18749
The type=track branch authorises on ismycasetattach.case only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has or is sent its uuid — leaks not-yet-released coordinator material to...
CVE-2026-18749
A vulnerability exists in the VinceTrack system where the type=track branch incorrectly authorizes access based only on _is_my_case(t_attach.case) without checking the VinceTrackAttachment.shared status. This flaw allows any case member who possesses or is sent the UUID of a coordinator-uploaded ...
PT-2026-71334
The type=track branch authorises on is my caset attach.case only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has or is sent its uuid — leaks not-yet-released coordinator material to...
CVE-2026-18749: Authorization Bypass Through User-Controlled Key
The type=track branch authorises on ismycasetattach.case only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has or is sent its uuid — leaks not-yet-released coordinator material to...
Malicious code in dolyame-boxy-stories-of-block (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e18c95ca0abb6765cd4e9eb0ac8661962453f51c14d55902402a3b861d8ff16 On require of the package's main entry, index.js unconditionally loads support.js, which reconstructs hostnames from split-string arrays e.g...
Extending Detection Engineering to Digital Forensics: The Velociraptor Unified Detection-Forensics Methodology
Detection engineering and digital forensics have evolved in parallel rather than in partnership, leaving a gap between real-time alerting and forensic analysis. This paper develops a unified detection-forensics methodology using Velociraptor, where detection logic directly initiates targeted...
SSRF via URL Authority Bypass in GitHub Import — Unique Vulnerability (Not a Duplicate)
Why This Is NOT a Duplicate Two SSRF reports were previously submitted for this project: 1. Oct 2024 — lollms/internet.py → scrapeandsave → ScrapeMasterurl — zero URL validation 2. Feb 2026 — stores.py /scrape-url + artefacts.py /importurl → ScrapeMasterurl — zero URL validation marked duplicate...
SSRF via Unvalidated URL in Artefact Import and Datastore Scrape (Incomplete CVE-2026-0560 Fix)
Description The fix for CVE-2026-0560 commit 76a54f0 added validateurl SSRF protection to backend/routers/files.py only. Two other endpoints that fetch user-supplied URLs have no SSRF protection and pass attacker-controlled URLs directly to ScrapeMaster: 1. POST...
