AlmaLinux 9.2 [TuxCare] Security Update: pki-servlet-4.0-api / pki-servlet-engine Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1764580671)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1764580671 advisory. - Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from...

Prototype Pollution

joi is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of proto keys during message compilation, which allows an attacker to manipulate the returned object's prototype and disrupt downstream code that relies on Object.prototype methods...

CVE-2021-31630

CVE-2021-31630 HTB 머신을 공격할 때 마주친 CVE입니다. exploit-db의 exp에는 오류가 있어서 수동 공격 방법과 exp를 제공합니다. 스크립트 사용 명령 실행 시 출력이 표시되지 않습니다 python exp.py -u http://127.0.0.1:8080 -l openplc -p openplc -c "whoami" 수동 exp 백엔드의 공격 체인은 다음과 같습니다. st 프로젝트를 생성하고 컴파일 → hardware 탭에 악성 코드를 추가한 후 프로젝트 본체에 컴파일 → start로 프로젝트를 실행하...

CVE-2024-6387fixshell

CVE-2024-6387fixshell 8.5p1 = OpenSSH 9.8p1에만 영향을 미칩니다 컴파일 종속성 설치 sudo apt-get update sudo apt-get install -y build-essential zlib1g-dev libssl-dev 지정된 버전의 소스 코드 다운로드 wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.8p1.tar.gz 압축 해제 및 디렉터리 이동 tar -xzf openssh-9.8p1.tar.gz cd...

ProyectoFinalSO

최종 프로젝트 — 운영체제 2026-2 저자: Reyna Mendez Cristian Ignacio 요구 사항 GitHub Codespaces 에 접근할 수 있는 GitHub 계정 Codespace에 약 10GB의 여유 공간 커널 컴파일 컴파일에 약 20분 1단계 — Codespaces에서 클론 및 열기 git clone https://github.com/zKaaanon/ProyectoFinalSO.git 또는 GitHub에서 직접: 1. 저장소에 들어가기 2. 초록색 Code 버튼 누르기 3. Codespaces 탭으로 가기...

CVE-2021-31630

OpenPLC WebServer v3 - Authenticated RCE CVE-2021-31630 이 익스플로잇은 Fellipe Oliveira가 만든 Exploit-DB의 익스플로잇을 기반으로 합니다. 먼저 인증합니다 악성 C 파일을 업로드합니다 컴파일합니다 PLC를 시작합니다 리버스 셸 시작 PLC를 중지합니다 실행할 필요는 없으며, 리버스 셸은 이미 시작되었습니다 └─ python3 customexploit.py --url http://10.10.11.7:8080 --username openplc --password...

CVE-2026-93348

A flaw was found in Unsloth Zoo, which can lead to arbitrary code execution when loading a machine learning model. The vulnerability exists due to improper input sanitization of the model type parameter within configuration files during compilation. An attacker can exploit this issue by supplying...

joi: joi: Prototype Pollution via custom messages

A flaw was found in joi. This vulnerability, known as prototype pollution, exists in the messages compilation function. A remote attacker can exploit this by supplying specially crafted proto keys in custom messages. This allows the attacker to manipulate object properties, which could lead to...

CVE-2026-90771

A flaw was found in joi. This vulnerability, known as prototype pollution, exists in the messages compilation function. A remote attacker can exploit this by supplying specially crafted proto keys in custom messages. This allows the attacker to manipulate object properties, which could lead to...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: usb: idmouse: Fixed an issue where an uninitialized value was present in idmouseopen. In idmousecreateimage, if any ftipcommand fails, it will proceed to the reset label. However, this results in the data in...

Astra Linux – Vulnerability in Tomcat9

The “Time-of-check Time-of-use” TOCTOU race condition vulnerability during JSP compilation in Apache Tomcat allows for a race condition on case-insensitive file systems when the default servlet is enabled for writing not in the default configuration. This issue affects Apache Tomcat versions from...

Astra Linux – Vulnerability in Firefox and Thunderbird

A potential memory corruption vulnerability could be triggered if an attacker had the ability to cause a “Out-of-Memory” exception at a specific moment during JIT compilation. This vulnerability affects Firefox 131, Firefox ESR 128.3, Thunderbird 128.3, and Thunderbird 131...

Astra Linux – Vulnerability in node-lodash

Impact: The fix for CVE-2021-23337 https://github.com/advisories/GHSA-35jh-r3h4-6jhm added validation for the variable option in .template, but did not apply the same validation to options.imports key names. Both paths flow into the same Function constructor sink. When an application passes...

Astra Linux – Vulnerability in pcre2

A out-of-bounds read vulnerability was discovered in the PCRE2 library, specifically in the getrecursedatalength function of the pcre2jitcompile.c file. This issue affects recursions in JIT-compiled regular expressions due to duplicate data transfers...

Astra Linux – Vulnerability in zlib, libz-mingw-w64

Before version 1.2.12, zlib allowed memory corruption during deflation i.e., when compressing if the input contained many distant matches...

Medium: libreoffice

Issue Overview: LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow existed when importing a DXF polyline. The point count taken from the file was truncated to a 16-bit value when the point buffer was sized, while the full count was used to fill it, so a...

Linux Distros Unpatched Vulnerability : CVE-2026-90771

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code...

CVE-2026-90771

joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object's prototype, breaking downstream code relying on...

EUVD-2026-76992

joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object's prototype, breaking downstream code relying on...

CVE-2026-90771

joi (the Hapi.js validation library) before versions 17.13.8 and 18.2.9 is affected by a prototype pollution vulnerability in the messages compilation function . The root cause is that the function accepts __proto__ as a valid error code, allowing an attacker to supply __proto__ keys in custom er...