365 matches found
CVE-2026-42533
CVE-2026-42533 — nginx map/regex capture clobbering tracking site Source for the CVE-2026-42533 patch-status tracker: a single-page site recording which distributions have shipped a fix for the nginx map/regex capture-clobbering heap overflow. Where the facts live Everything about the bug —...
CVE-2026-42533
CVE-2026-42533 — nginx ヒープバッファオーバーフロー PoC エクスプロイト 2パスキャプチャ破壊による事前認証リモートコード実行 公開 PoC リリース: 2026-07-27 — 待たずに今すぐパッチを適用してください。 | ---|--- CVE| CVE-2026-42533 CVSS 4.0| 9.2 重大 種別| ヒープバッファオーバーフロー CWE-122 影響を受けるバージョン| nginx 0.9.6 – 1.30.3 stable、0.9.6 – 1.31.2 mainline 修正バージョン| nginx 1.30.4 / 1.31.3、NGI...
ghostlock-vagrant-box
Banco de pruebas de vulnerabilidad de cadena completa: Nginx RCE → GhostLock LPE Descripción general Este repositorio proporciona un entorno Vagrant diseñado para demostrar una cadena de explotación completa en dos etapas. El banco de pruebas aprovisiona automáticamente una máquina virtual Ubuntu...
CVE-2026-64638
CVE-2026-64638 // XSS2Shell CVE-2026-64638 （ XSS2Shell ）の技術分析と防御的緩和マトリクス。WordPress Core の認証画面におけるパース処理の重大な不整合を悪用し、認証前の反射型 Cross-Site Scripting（XSS）をブラウザのプリミティブと連鎖させ、リモートコード実行（RCE）にまで到達させるものです。 🛠️ エグゼクティブサマリー ベクターID: CVE-2026-64638 コードネーム: XSS2Shell 深刻度: 高（CVSS 4.0: 8.9） CWE分類:...
Linux Distros Unpatched Vulnerability : CVE-2026-80663
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tools/power/x86/intel-speed-select: Harden daemon pidfile open Avoid symlink-based pidfile clobbering by opening the pidfile with ONOFOLLOW and validating it wi...
XSS2Shell-CVE-2026-64638
CVE-2026-64638 — XSS2Shell WordPress 事前認証反映型XSS → リモートコード実行チェーン DOM Clobbering + アプリケーションパスワード窃取 + REST API プラグイン有効化 = 完全なRCE ⚡ 概要 CVE-2026-64638 は、WordPress の wp-login.php における重大な事前認証型反映XSS です。この脆弱性は、ログインエラーメッセージが送信されたユーザー名を適切なHTMLエンコードなしで 反映するために存在し、 によるDOM Clobberingを可能にして、ほとんどのフィルタを回避します。...
CVE-2026-42533-Config-Scanner
nginx capture-clobber scanner A read-only static scanner that flags nginx configurations vulnerable to the complexvalue two-pass capture-clobbering bug class F5/nginx SIRT advisory, July 2026. It parses your config and reports the vulnerable pattern with the reason and location. It does not explo...
poc-CVE-2026-64638-
XSS2Shell — CVE-2026-64638 PoC Cadeia de exploração WordPress Pre-Auth XSS → RCE, baseada em pesquisa de pwn.ai publicada em ionsec.io. ⚠️ AVISO LEGAL : Apenas para FINS EDUCACIONAIS e TESTES AUTORIZADOS. Use somente contra sistemas que você possui ou para os quais tenha permissão explícita por...
CVE-2026-64638
CVE-2026-64638 XSS riflesso sulla schermata di login che porta all'esecuzione di codice PHP — WordPress Core Software: WordPress Core ≤ 7.0.2 tutte le versioni precedenti alla 7.0.3 CVSS: 8.9 Alto CWE: CWE-79 — Neutralizzazione impropria dell'input durante la generazione di pagine web...
CVE-2026-42533-nginx
CVE-2026-42533 nginx यह रिपॉजिटरी CVE-2026-42533 में वर्णित complexvalue two-pass capture-clobbering समस्या से जुड़े nginx कॉन्फ़िगरेशन पैटर्न की पहचान करने के लिए एक Go-आधारित स्कैनर शामिल करती है। अवलोकन यह टूल nginx कॉन्फ़िगरेशन फ़ाइलों और निर्देशिकाओं का विश्लेषण करता है ताकि उन जोखिम भरे...
CVE-2026-42533
CVE-2026-42533 — nginx: Zwei-Pass-Capture-Überschreibung two-pass capture clobbering nginx 0.9.6–1.30.3 / mainline ≤1.31.2 Pre-Authentifizierungs-Heap-Overflow + Informationsleck in der komplexen Wert-Skript-Engine; CVSS 9.2. Dieselbe Grundursache hat zwei Angriffsflächen: HTTP Regex-location +...
CVE-2026-80663
In the Linux kernel, the following vulnerability has been resolved: tools/power/x86/intel-speed-select: Harden daemon pidfile open Avoid symlink-based pidfile clobbering by opening the pidfile with ONOFOLLOW and validating it with fstat before locking/writing. The daemon currently uses a fixed...
UBUNTU-CVE-2026-80663
In the Linux kernel, the following vulnerability has been resolved: tools/power/x86/intel-speed-select: Harden daemon pidfile open Avoid symlink-based pidfile clobbering by opening the pidfile with ONOFOLLOW and validating it with fstat before locking/writing. The daemon currently uses a fixed...
CVE-2026-80663
In the Linux kernel, the following vulnerability has been resolved: tools/power/x86/intel-speed-select: Harden daemon pidfile open Avoid symlink-based pidfile clobbering by opening the pidfile with ONOFOLLOW and validating it with fstat before locking/writing. The daemon currently uses a fixed...
UBUNTU-CVE-2026-80702
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: fix guestmemorydirty bitfield clobbered as size Two sites in vmwgfxresource.c assign boolean literals to res-guestmemorysize, which is an unsigned long allocation-size field; the intended target is the adjacent...
CVE-2026-80663 tools/power/x86/intel-speed-select: Harden daemon pidfile open
In the Linux kernel, the following vulnerability has been resolved: tools/power/x86/intel-speed-select: Harden daemon pidfile open Avoid symlink-based pidfile clobbering by opening the pidfile with ONOFOLLOW and validating it with fstat before locking/writing. The daemon currently uses a fixed...
EUVD-2026-67539
In the Linux kernel, the following vulnerability has been resolved: tools/power/x86/intel-speed-select: Harden daemon pidfile open Avoid symlink-based pidfile clobbering by opening the pidfile with ONOFOLLOW and validating it with fstat before locking/writing. The daemon currently uses a fixed...
CVE-2026-80663 tools/power/x86/intel-speed-select: Harden daemon pidfile open
In the Linux kernel, the following vulnerability has been resolved: tools/power/x86/intel-speed-select: Harden daemon pidfile open Avoid symlink-based pidfile clobbering by opening the pidfile with ONOFOLLOW and validating it with fstat before locking/writing. The daemon currently uses a fixed...
Astra Linux – Vulnerability in Puma
Puma is a Ruby/Rack web server designed for parallelism. In affected versions, clients could manipulate values set by intermediate proxies such as X-Forwarded-For by providing a version of the header with an underscore . Any users who rely on proxy-defined headers are affected. Versions...
