132 matches found
covert-tube
covert-tube A program to control systems remotely by uploading videos to Youtube using Python to create the videos and the listener, emulating some malware I was reading about. It allows to create videos with frames formed of simple text, QR codes with cleartext or QR codes using AES encryption...
CVE-2023-33246_RocketMQ_RCE_EXPLOIT
CVE-2023-33246 Exploit de Ejecución Remota de Código en RocketMQ CVE-2023-33246 Exploit de Ejecución Remota de Código en RocketMQ Resumen RocketMQ es una plataforma de mensajería y transmisión distribuida. Las versiones de RocketMQ 5.1.0 y anteriores son vulnerables a la Inyección Arbitraria de...
CVE-2023-33246_RocketMQ_RCE_EXP
CVE-2023-33246RocketMQRCEEXP CVE-2023-33246 RocketMQ 远程代码执行利用工具 概述 RocketMQ 5.1.0 及以下版本存在任意代码注入漏洞。Broker 组件暴露在外网且缺乏权限验证。攻击者可利用此漏洞，通过更新配置功能以运行 RocketMQ 的系统用户身份执行命令。此外，攻击者还可通过伪造 RocketMQ 协议内容达到相同效果。 检测 RocketMQ 版本以识别漏洞 使用示例 检测 root@kitploit: ./RocketMQRceCheck -host 127.0.0.1 -port 9876 利用...
Apache-RocketMQ-CVE-2023-33246-
CVE-2023-33246：Apache RocketMQ 远程代码执行 概述 Apache RocketMQ 是最流行且广泛使用的分布式消息和流处理平台之一。 最近报道了 Apache RocketMQ 中存在一个命令执行漏洞，影响版本 5.1.0 及以下。远程未认证用户可以通过使用更新配置功能来利用此漏洞，以与 RocketMQ 用户进程相同的访问级别执行命令。 核心组件 命名服务器： 1. RocketMQ 中的命名服务器充当整个消息基础设施的注册表或元数据存储。 2. 它维护有关主题、队列以及负责处理消息的代理的信息。 3...
CVE-2026-84650
Jenkins versions 2.579 and earlier and LTS 2.568.2 and earlier are affected by an unsafe deserialization flaw (SECURITY-4032). Fields declared transient are excluded from serialization but still read back during deserialization for backward compatibility with existing configuration files. Attacke...
SUSE-SU-2026:2642-1 Security update for apache-commons-configuration2, apache-commons-text
This update for apache-commons-configuration2, apache-commons-text fixes the following issues - CVE-2026-45205: uncontrolled recursion leads to StackOverflowError when processing specially crafted configuration files bsc1265299. Changes for apache-commons-configuration2: - Upgrade to version...
CVE-2026-55741
Cotonti 1.0.0 (master, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the admin configuration handler. The vulnerability occurs in system/admin/admin.config.php where the update action (a=update) processes POST data via cot_config_update_options() without calling cot_check_xg() t...
Exploit for Out-of-bounds Write in Linux Linux_Kernel
CVE-2026-43500 / CVE-2026-43284 / Dirty Frag mitigation rxrpc...
CVE-2026-40925 WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials
WWBN AVideo is an open source video platform. In versions 29.0 and prior, objects/configurationUpdate.json.php also routed via /updateConfig persists dozens of global site settings from $POST but protects the endpoint only with User::isAdmin. It does not call forbidIfIsUntrustedRequest, does not...
WWBN AVideo 跨站请求伪造漏洞
WWBN AVideo is a video platform building system developed by the WWBN team using PHP. Versions of WWBN AVideo prior to 29.0 contained a cross-site request forgeing vulnerability. This vulnerability stemmed from the objects/configurationUpdate.json.php file, which protected the endpoint through...
WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials
Summary objects/configurationUpdate.json.php also routed via /updateConfig persists dozens of global site settings from $POST but protects the endpoint only with User::isAdmin. It does not call forbidIfIsUntrustedRequest, does not verify a globalToken, and does not validate the Origin/Referer...
EUVD-2026-16458
A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the file /dbfood/localhost.sql. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exploit has been made available to the public and...
CVE-2026-4532
A security vulnerability has been detected in code-projects Simple Food Ordering System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /food/sql/food.sql of the component Database Backup Handler. The manipulation leads to files or directories accessible. It is...
CVE-2026-4532 code-projects Simple Food Ordering System Database Backup food.sql file access
A security vulnerability has been detected in code-projects Simple Food Ordering System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /food/sql/food.sql of the component Database Backup Handler. The manipulation leads to files or directories accessible. It is...
GHSA-7XHJ-55Q9-PC3M OpenClaw's hook transform module path allows traversal and arbitrary JavaScript module loading
Summary OpenClaw hook mapping transforms could be loaded via absolute paths or .. traversal, allowing arbitrary JavaScript module loading/execution in the gateway process when an attacker can modify hooks configuration. Affected Versions - Affected: = 2.0.0-beta3 and = 2026.2.13 - Fixed: 2026.2.1...
CVE-2026-28516
openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without prepared statements or proper input...
CVE-2026-27849
Due to missing neutralization of special elements, OS commands can be injected via the update functionality of a TLS-SRP connection, which is normally used for configuring devices inside the mesh network. This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200...
cups security update
An update is available for cups. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Common UNIX Printing System CUPS provides a portable printing layer for Linu...
ALSA-2026:0464 Moderate: cups security update
The Common UNIX Printing System CUPS provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fixes: CUPS: Local denial-of-service via cupsd.conf update and related issues CVE-2025-61915 cups: Slow client communication leads to a possible DoS attack CVE-2025-584...
