285652 matches found
CVE-2026-106451
The yawkat LZ4 Java library (versions 1.7.0 through 1.11.4 ) is vulnerable to a TOCTOU race condition during native library extraction. The net.jpountz.util.Native.load() function creates a temporary .lck file but uses a predictable path for the actual native library. Because FileOutputStream ope...
CVE-2026-101157 Security Advisory 0192
A stored cross-site scripting XSS vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views affected content. Successful exploitation may allow the attacker to compromise the victim's authenticated...
CVE-2026-102156
Improper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input allows an unauthenticated network attacker to inject queries against a configured directory service. This vulnerability occurs under high-complexity conditions and could impact the confidentiality of the ...
CVE-2026-102156 Security Advisory 0191
Improper neutralization of Lightweight Directory Access Protocol LDAP authentication input may allow an unauthenticated network attacker, under high-complexity conditions, to inject queries against the configured directory service...
EUVD-2026-93951
An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Software Management Studio Software Repository...
CVE-2026-101155 Security Advisory 0189
An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Software Management Studio Software Repository...
EUVD-2026-93948
Insufficient validation in the Single Sign-On SSO login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, causes the identity provider IdP to deliver authentication material to an attacker-controlled URL instead of to CloudVision...
CVE-2026-101152 Security Advisory 0187
Insufficient validation in the Single Sign-On SSO login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, causes the identity provider IdP to deliver authentication material to an attacker-controlled URL instead of to CloudVision...
CVE-2026-104047
A vulnerability exists in SSSD when configured to use Microsoft Entra ID . The issue stems from a lack of proper sanitization of search inputs before they are incorporated into directory query filters, leading to a query injection flaw. A local user can exploit this by submitting a crafted lookup...
CVE-2026-104047
A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A local user can exploit this vulnerability by submitting a crafted lookup request, manipulating the query logic to cause...
CVE-2020-10135-BIAS
CVE-2020-10135-BIAS CVE 2020-10135 又名 BIAS（蓝牙冒充攻击） 看起来经过一段时间并费了一些周折后，我成功执行了 BIAS（蓝牙冒充攻击）CVE-2020-10135。冒充了 Samsung S3 Neo+ 与 Linux 主机的连接。很酷的东西。感谢 Internalblue 和 BIAS PoC。 从我的角度来看，我发现执行该攻击几乎只需要被冒充设备的 BT 地址，该设备此前已与另一端配对并连接。其余信息你都可以获取，以便 PoC 正常工作。 PoC/原始作者: https://github.com/francozappa/bias 日志 No...
CVE-2020-0665
CVE-2020-0665 - SID筛选绕过 CVE-2020-0665 的概念验证，该漏洞允许绕过 Active Directory 森林中的 SID 筛选（跨森林攻击）。 攻击要求 目标域控制器机器必须在2020年2月之后未 打补丁。 已攻陷一个信任其他森林的域控制器（此攻击需要高权限，如 SYSTEM 用户）。 与目标森林建立了双向传递信任关系。 在被攻陷的域控制器上安装了 python2.7，以及在被攻陷的信任森林中安装了 frida 库 pip2 install frida。P.S.：我尚未用 python3 测试过，但或许也能运行？ 被攻陷域中有一个子域及其...
SocialBox
SocialBox SocialBox 是一个暴力破解攻击框架 Facebook , Gmail , Instagram ,Twitter ，由 Belahsan Ouerghi 编写。 安装 sudo apt-get install git git clone https://github.com/TunisianEagles/SocialBox.git cd SocialBox chmod +x SocialBox.sh chmod +x install-sb.sh ./install-sb.sh ./SocialBox.sh 截图： 测试环境： Backbox linux Ubun...
CVE-2026-9226
Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured login-session token exposed in a redirect URL...
CVE-2026-106418
Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: Low...
CVE-2026-106398
Incorrect authorization in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-106402
Incorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. Chromium security severity: Medium...
DEBIAN-CVE-2026-106395
Uninitialized resource in Dawn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. Chromium security severity: Medium...