CVE-2024-3094

CVE-2024-3094 CVE-2024-3094 ist eine kritische Sicherheitslücke, die in den Upstream-Tarballs des xz-Dienstprogramms ab Version 5.6.0 entdeckt wurde. Diese Schwachstelle beinhaltet schädlichen Code, der durch komplexe Verschleierungen den Build-Prozess von liblzma manipuliert. Wozu dient dieses...

pacumen

Non è necessario installare. Ma esegui python setup.py build per installare le dipendenze automaticamente...

-CVE-2024-3094-Vulnerability-Checker-Fixer-Public

Zeigen Sie Ihre Unterstützung Wenn Sie dieses Skript nützlich finden und es Ihnen geholfen hat, Ihre Systeme vor CVE-2024-3094 zu schützen, ziehen Sie bitte in Betracht, ihm einen Stern ⭐ zu geben. Das Markieren dieses Repositorys mit einem Stern zeigt nicht nur Ihre Unterstützung, sondern hilft...

CVE-2023-51444

Questo README ti aiuta a iniziare con lo sviluppo di GeoServer. Ti guiderà attraverso il processo di checkout del codice sorgente, compilazione ed esecuzione. Lo sviluppo di GeoServer richiede Java 8, Maven e git. A causa di sottili modifiche nelle librerie delle classi Java, al momento richiedia...

ingress-nginx-0.21-1.19.5

BAU: root@kitploit: cd ./ingress-nginx-0.21-1.19.5 cd images/nginx/ make cd - cd images/e2e/ make docker-build cd - e2etag=docker images|grep e2e|awk 'print $2' sed -i "s/e2e:v12232020-dce860a/e2e:$e2etag/" build/go-in-docker.sh make echo -e '\n\n\n\n\n' docker images|grep ingress-nginx...

Exploit for Eval Injection in Langflow

CVE-2026-33017 Langflow RCE ★ CVE-2026-33017 Langflow Remote...

CVE-2026-75569

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute...

EUVD-2026-63087

A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build...

CVE-2026-76139 Acm-operator-bundle: acm-operator-bundle: bundle build execs unpinned stolostron/release@master with full build credentials

A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build...

CVE-2026-75569

mce-operator-bundle (Red Hat) contains a build-time supply chain flaw: the bundle-generation process fetches business logic from the mutable branch stolostron/release@master without commit pinning or signature verification. An attacker with write access to that remote repository can inject arbitr...

EUVD-2026-63086

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute...

CVE-2026-75569 Mce-operator-bundle: mce-operator-bundle: bundle-generation business logic fetched from mutable stolostron/release@master

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute...

CVE-2026-75569 Mce-operator-bundle: mce-operator-bundle: bundle-generation business logic fetched from mutable stolostron/release@master

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute...

CVE-2026-75926 Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant

Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in...

CVE-2026-58404

A flaw was found in Hugo, a static site generator. The default security policy intended to deny requests to loopback, internal, and cloud-metadata IPv4 addresses could be bypassed. This occurred because the deny rule only matched dotted-decimal notation, allowing alternate IPv4 encodings integer,...

Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container

Summary Nuclio Dashboard exposes POST /api/functions without authentication by default NOP auth mode. The spec.handler field e.g., mymodule:myfunction is parsed by functionconfig.ParseHandler which splits on : only — no path validation is applied to the module portion. During function build,...

Cleartext Storage of Sensitive Information in Memory

Overview Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information in Memory in the Build process. An attacker can recover sensitive cryptographic material by reading process memory through methods such as core dumps, swap files, or memory scraping. Remediatio...

Malicious code in animatecss-postcss-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6be12cec08d0999c157774b746c3e431825ae61635bb8ddddf36061d4602cec7 [email protected] ships a tiny PostCSS plugin factory whose body contains an obfuscator.io-style string-array + RC4 decoder functions...

@a1st/aix (>=0.0.3, <=0.6.0), @a1st/aix-core (>=0.2.0, <=0.6.0) +19 more potentially affected by CVE-2026-54298 via astro (>=6.0.0-beta.1, <=6.4.4)

astro NPM version =6.0.0-beta.1, =0.0.3, =0.2.0, =1.11.1, =2.7.0, =0.3.0, =1.4.1, =0.19.0, =0.19.0, =1.10.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-54298 Source advisory: OSV:GHSA-JRPJ-WCV7-9FH9...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the pbjs static code generation. An attacker can execute arbitrary code by providing crafted schema names that are incorporated into generated JavaScript output, which is then executed or imported by the...