GitList < 0.6.0 Remote Code Execution

klaussilveira GitList version = 0.6 contains a passing incorrectly sanitized input via the searchTree function that can result in remote code execution. id: CVE-2018-1000533 info: name: GitList 0.6.0 Remote Code Execution author: pikpikcu severity: critical description: klaussilveira GitList...

SAP Internet Graphics Server (IGS) - XML External Entity Injection

SAP Internet Graphics Servers IGS running versions 7.20, 7.20EXT, 7.45, 7.49, or 7.53 has two XML external entity injection XXE vulnerabilities within the XMLCHART page - CVE-2018-2392 and CVE-2018-2393. These vulnerabilities occur due to a lack of appropriate validation on the Extension HTML tag...

Agentejo Cockpit <0.12.0 - NoSQL Injection

Agentejo Cockpit prior to 0.12.0 is vulnerable to NoSQL Injection via the newpassword method of the Auth controller, which is responsible for displaying the user password reset form. id: CVE-2020-35848 info: name: Agentejo Cockpit 0.12.0 - NoSQL Injection author: dwisiswant0 severity: critical...

Mlflow <2.2.1 - Local File Inclusion

Mlflow before 2.2.1 is susceptible to local file inclusion due to path traversal ..\filename in GitHub repository mlflow/mlflow. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id:...

Mlflow <2.9.2 - Path Traversal

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. id: CVE-2023-6909 info: name: Mlflow 2.9.2 - Path Traversal author: Hyunsoo-ds severity: high description: | Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. impact: | Successful...

JumpServer > 3.6.4 - Information Disclosure

JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not...

GitLab CI Lint API - Server-Side Request Forgery

GitLab 10.5 and later contain a server-side request forgery caused by insecure handling of webhook requests, letting unauthenticated attackers exploit the server for arbitrary requests, exploit requires sending crafted webhook requests. id: CVE-2021-22175 info: name: GitLab CI Lint API -...

elFinder 2.1.58 - Remote Code Execution

elFinder 2.1.58 is impacted by multiple remote code execution vulnerabilities that could allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. id: CVE-2021-32682 info: name: elFinder 2.1.58 - Remote Code Executi...

OneDev < 4.0.3 - User Access Token Leak

OneDev before version 4.0.3 contains an insecure endpoint that allows retrieval of arbitrary user details, including access tokens, due to missing security checks on /users/id, letting attackers leak sensitive data and impersonate users, exploit requires no special conditions. id: CVE-2021-21246...

404 to 301 <= 2.0.2 - Authenticated Blind SQL Injection

The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability. id: CVE-2015-9323 info: name: 404 to 301 = 2.0.2 - Authenticated Blind SQL Injection author: Harsh severity: critical description: | The 404 to 301 –...

Symfony Profiler - Remote Access via Injected Arguments

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the registerargvargc php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by...

RingBufferDetonator

Détonateur de Tampon Annulaire Ceci est un programme de preuve de concept pour déclencher et prouver un bug logique dans rbpercpuempty. Les programmes qui rencontrent le bug seront bloqués dans une boucle infinie dans l'espace noyau dans tracingreadpipe et impossibles à suspendre ou terminer avec...

log4jshield

Démo • Fonctionnalités • Prérequis • Installation • Utilisation • Contribuer • Contact Log4j Shield - un outil de recherche et de correction rapide ⚡, évolutif et facile à utiliser Aucune vulnérabilité Log4j laissée de côté Vous pouvez utiliser cet outil pour analyser tous les fichiers JAR affect...

Firefox-ANGLE-CVE-2024-0741

Corrigé dans Firefox 123. Correctif : https://source.chromium.org/chromium//chromium/angle/angle/+/f8fae1ff4fae14fc6ba0aa1dc3af2e13a6e9a597. Cherry-pick : https://github.com/mozilla/angle/commit/ddaf44ac75d5d0390873c2af193e02159ecbe672...

cve-2020-27955

cve-2020-27955 cve-2020-27955 Reproduction 1. Créer un dépôt GitHub 2. git clone https://github.com/attacker/poc.git . 3. echo calc.exe git.cmd 4. git lfs track “.dat” 5. echo “Junk” large.dat 6. git add -A 7. git commit -m “POC” 8. git push -u origin master -f...

pepeScraper

pepeScraper - scraper 4chan Un scraper complet pour 4chan Et c'est rapide. pepeScraper est un scraper qui utilise le contexte pour vos recherches et renvoie exactement ce que vous voulez. J'apprends à rendre un objet plus cool qu'il ne l'est en réalité. Saisissez des mots-clés, tout ce qui vous...

bugsy

Bugsy Bugsy is a command-line interface CLI tool that provides automatic security vulnerability remediation for your code. It is the community edition version of Mobb, the first vendor-agnostic automated security vulnerability remediation tool. Bugsy is designed to help developers quickly identif...

freebsd-dirent-info-leak-bugs

Comment ai-je trouvé les bugs ? 1. Décider aléatoirement d'auditer les systèmes de fichiers de FreeBSD 2. Faire quelques recherches et découvrir que le système de fichiers par défaut est une combinaison de FFS et UFS 3. Passer du temps à auditer ufscreate et trouver 0 bugs 4. Aller ici et examine...

CVE-2024-4947

CVE-2024-4947 Un bug de confusion de type V8 découvert dans la nature. Ce dépôt contient Analyse et PoCs pour escalader cette vulnérabilité afin d'obtenir le même schéma d'exploitation que CVE-2024-12695, Object Hash Reassign. Primitives AddressOf / FakeObject construites en utilisant la confusio...

CVE-2025-30208

中文 | Anglais Scanner de vulnérabilités du serveur de développement Vite 一个内外网通的自动化扫描器 Un outil automatisé pour identifier les vulnérabilités du serveur de développement Vite. Cet outil utilise l'API FOFA pour collecter des cibles potentielles et détecte automatiquement des vulnérabilités...