208245 matches found
EUVD-2026-83165
A vulnerability was identified in spatie Scotty up to 1.4.2. Affected is the function SelfUpdater::update of the file app/Updater/SelfUpdater.php of the component Self Update Handler. Such manipulation leads to download of code without integrity check. It is possible to launch the attack remotely...
EUVD-2026-83128
A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affects the function application/modules/global/controllers/password.php::simpan/application/modules/global/controllers/profil.php::simpan of the file...
EUVD-2026-82988
A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects unknown code. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been made available to the public an...
CVE-2026-92747
A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine VM credentials, such as rootPassword and userPassword. This occurs when the installmachine.py script passes these credentials as...
CVE-2026-93534
A vulnerability was identified in spatie Scotty up to 1.4.2. Affected is the function SelfUpdater::update of the file app/Updater/SelfUpdater.php of the component Self Update Handler. Such manipulation leads to download of code without integrity check. It is possible to launch the attack remotely...
CVE-2026-63405
AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the caller-supplied bodymd5 value in the HMAC input but does not calculate the digest of the received request body or compare it...
EUVD-2026-83180
AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the caller-supplied bodymd5 value in the HMAC input but does not calculate the digest of the received request body or compare it...
CVE-2026-93534 spatie Scotty Self Update SelfUpdater.php update code download
A vulnerability was identified in spatie Scotty up to 1.4.2. Affected is the function SelfUpdater::update of the file app/Updater/SelfUpdater.php of the component Self Update Handler. Such manipulation leads to download of code without integrity check. It is possible to launch the attack remotely...
CVE-2026-93534
spatie Scotty (versions up to 1.4.2 ) is affected by a vulnerability in the SelfUpdater::update function within app/Updater/SelfUpdater.php, part of the Self Update Handler component. The root cause is that the self-update process downloads code without an integrity check , allowing an attacker t...
CVE-2026-93531
A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects unknown code. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been made available to the public an...
CVE-2026-54147
http4k-security-digest (a module of the Kotlin HTTP toolkit http4k) contains a bug in DigestAuthProvider.verify where the configured algorithm parameter is silently ignored and every digest response is verified with hardcoded MD5 , regardless of the intended algorithm. Deployments believing they ...
CVE-2026-93531
CVE-2026-93531 affects gedelumbung HospitalManagement (up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8), introducing a cross-site request forgery (CSRF) weakness in unspecified code. The attack is remote , requires no prior privileges but does require user interaction , resulting in a low i...
proxy
git-pkgs proxy A caching proxy for package registries. Speeds up package downloads by caching artifacts locally, reducing bandwidth usage and improving reliability. Version Cooldown Most supply chain attacks rely on speed: a malicious version gets published and consumed by automated pipelines...
CVE-2021-30146
CVE-2021-30146 Seafile 7.0.5 XSS Persistente Descripción sugerida: La aplicación versión del servidor: Seafile 7.0.5 es vulnerable a XSS persistente a través de la funcionalidad de compartir bibliotecas. Información adicional: Seafile es una solución de sincronización y uso compartido de archivos...
jwt-hack
JSON Web Token 黑客工具包 一个用于测试、分析和攻击 JSON Web Token 的高性能工具包。 安装 Cargo root@kitploit: cargo install jwt-hack Homebrew root@kitploit: brew install jwt-hack Snapcraft Ubuntu root@kitploit: sudo snap install jwt-hack 从源码构建 root@kitploit: git clone https://github.com/hahwul/jwt-hack cd jwt-hack cargo...
PenScope
██████╗ ███████╗███╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ███████╗ ██╔══██╗██╔════╝████╗ ██║██╔════╝██╔════╝██╔═══██╗██╔══██╗██╔════╝ ██████╔╝█████╗ ██╔██╗ ██║███████╗██║ ██║ ██║██████╔╝█████╗ ██╔═══╝ ██╔══╝ ██║╚██╗██║╚════██║██║ ██║ ██║██╔═══╝ ██╔══╝ ██║ ███████╗██║...
Centry
Centry ADVERTENCIA: ESTE ES UN SOFTWARE EXPERIMENTAL. ES PROBABLE QUE CONTENGA ERRORES. Actualizaciones Si ya has instalado Centry, por favor ejecuta git pull para actualizar a la última versión. Las últimas actualizaciones lo hacen mucho más seguro contra ataques de repetición. Introducción Cent...
k8scout
k8scout Beta — 用于授权安全评估的单一二进制 Kubernetes 攻击路径引擎。 将其放入被攻破的 Pod，运行它，即可获得每个现实可行的横向移动路径地图——从当前落脚点到集群管理员、节点访问、机密窃取和云 IAM 角色。 理念 你在 Kubernetes Pod 中拥有 RCE。接下来呢？ k8scout 回答这个问题。它自动发现被攻破 Pod 的服务账户能做什么，映射 RBAC 图，并追踪从你的确切落脚点到高价值目标的攻击路径。 它有三种工作模式： 攻击模式 （默认）—— 在被攻破的 Pod 内运行。发现你的身份、权限以及从当前位置可达到的所有横向移动路径。 审查模式...
CVE-2020-23586
CVE-2020-23586 OPTILINK E-PON "MODEL NO: OP-XT71000N" con "HARDWARE VERSION: V2.2"; y "FIRMWARE VERSION: OPV3.3.1-191028" vulnerabilidad encontrada en el "OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OPV3.3.1-191028" que permite a un atacante remoto no autenticado realizar un...