CVE-2021-22123

CVE-2021-22123 Fortinet FortiWeb Authentifizierte OS-Befehlseinschleusung Hit Counter Die Schwachstelle zur Befehlseinschleusung in der FortiWeb-Verwaltungsoberfläche könnte einem authentifizierten entfernten Angreifer ermöglichen, über die SAML-Serverkonfigurationsseite beliebige Befehle im Syst...

CVE-2020-6287

CVE-2020-6287 SAP NetWeaver AS JAVA LM Configuration Wizard Bypass di Autenticazione Crea Utente Java Semplice e Amministratore SAP NetWeaver è la piattaforma tecnologica integrata di SAP e il fondamento tecnico di tutte le applicazioni SAP a partire da SAP Business Suite. SAP NetWeaver è una...

CVE-2020-6286

CVE-2020-6286 SAP NetWeaver AS JAVA LM Configuration Wizard Directory Traversal SAP NetWeaver è la piattaforma tecnologica integrata di SAP e il fondamento tecnico di tutte le applicazioni SAP sin da SAP Business Suite. SAP NetWeaver è una piattaforma applicativa e di integrazione orientata ai...

CVE-2026-81697

The openssl-encrypt PyPI package (versions ≤ 1.4.8) contains a CWD-relative configuration file resolution flaw in crypt_settings.py, where CONFIG_FILE—originally set to the absolute per-user path ~/.crypt_settings.json—is reassigned at line 84 to the bare relative name crypt_settings.json. The le...

EUVD-2026-67029

The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given to its endpoint option into the user profile without passing it through createSafeUrl in src/config.ts, the helper that already restricted...

CVE-2026-81094 mcp-router CLI before 0.6.3 Binds the MCP Aggregator to All Interfaces Without Requiring Authentication

The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it. The serve command in apps/cli/src/commands/serve.ts defaulted its host to the all-interfaces address on a fixed port, and required a token only when the corresponding...

ecologyExp.jar

ecologyExp.jar Чтение файла конфигурации базы данных Weaver OA java -jar ecologyExp.jar http://127.0.0.1 Исходный код package com.test; import org.apache.http.HttpEntity; import org.apache.http.client.methods.CloseableHttpResponse; import org.apache.http.client.methods.HttpGet; import...

Hadoop-YARN-RCE

Nicht authentifizierte RCE im Apache Hadoop YARN ResourceManager Im Apache Hadoop YARN ResourceManager besteht eine Schwachstelle durch nicht autorisierten Zugriff , wenn seine REST-API Standardport 8088 oder RPC-Ports ohne aktivierte Authentifizierung exponiert sind. Standardmäßig lässt Hadoop...

CVE-2019-12409

CVE-2019-12409: RCE-Schwachstelle aufgrund einer schlechten Standardkonfiguration in Apache Solr Die Versionen 8.1.1 und 8.2.0 von Apache Solr enthalten unsichere Einstellungen in der mitgelieferten Standardkonfigurationsdatei solr.in.sh. Die Einstellungen, die zu dieser Schwachstelle führen, sin...

Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers

Cybersecurity researchers have disclosed details of a vulnerability in Amazon Kiro, an artificial intelligence AI-powered, agentic integrated development environment IDE, that could facilitate data exfiltration via prompt injection and Kiro Powers. The security flaw, which does not have a CVE...

CVE-2024-52301-Research

CVE-2024-52301-Forschung Ein wenig Recherche zu CVE-2024-52301. Ich habe die Schwachstelle gesehen und wollte herausfinden, wie Laravel angreifbar ist. Dazu habe ich einfach die Versionen 6.20.44 und 6.20.45 verglichen und nachvollzogen, wie GET-Parameter letztendlich die Anwendungskonfiguration...

Mitigate-CVE-2023-46747

Playbook Ansible per mitigare CVE-2023-46747 K000137353: Vulnerabilità di esecuzione di codice remoto non autenticata nell'utility di configurazione BIG-IP CVE-2023-46747 Ecco il link https://my.f5.com/manage/s/article/K000137353 Come utilizzarlo 1. Clona il mio repository con Git...

CVE-2022-43332

CVE-2022-43332 Cross Site Scripting in WonderCMS Descrizione: Una vulnerabilità di cross-site scripting XSS in Wondercms v3.3.4 consente a potenziali attaccanti di eseguire script web arbitrari o HTML tramite un payload appositamente creato iniettato nel campo Site title del Pannello di...

CVE-2026-76230

A flaw was found in Renovate. This vulnerability, a command injection, exists within the npm manager due to improper sanitization of user-provided package names. An attacker with write access to a repository can exploit this by crafting malicious Renovate configuration files. This allows them to...

CVE-2026-40369

Attention Dans exp.cpp, NTOKernelBase doit être défini par vous-même...

CVE-2026-81743 Flowintel Arbitrary Log File Path Allows Remote Code Execution via Template Injection

Affected versions of Flowintel allow the LOGFILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this configurable value, an administrator could set LOGFI...

CVE-2026-81743

Flowintel versions >=3.3.0 allow the LOG_FILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this value, an attacker with high privileges can set LOG_...

web-traffic-generator

web-traffic-generator A quick and dirty HTTP/S "organic" traffic generator. About Just a simple poorly written Python script that aimlessly "browses" the internet by starting at pre-defined ROOTURLS and randomly "clicking" links on pages until the pre-defined MAXDEPTH is met. I created this as a...

YellowKey-BitLocker-CVE-2026-45585

YellowKey BitLocker YellowKey BitLocker Recovery Tool esegue il backup delle chiavi di ripristino BitLocker e controlla la CVE-2026-45585 su Windows 10/11. Le ricerche per bitlocker yellowkey , yellowkey bitlocker , yellowkey github e yellowkey vulnerability portano qui. CLI + GUI portatili per i...

CVE-2026-81662 Flowintel Alert Settings Configuration Allows Remote Code Execution via Arbitrary Configuration Keys

Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines in conf/configmodule.py. The vulnerabl...