Hadoop-YARN-RCE

Nicht authentifizierte RCE im Apache Hadoop YARN ResourceManager Im Apache Hadoop YARN ResourceManager besteht eine Schwachstelle durch nicht autorisierten Zugriff , wenn seine REST-API Standardport 8088 oder RPC-Ports ohne aktivierte Authentifizierung exponiert sind. Standardmäßig lässt Hadoop...

CVE-2019-12409

CVE-2019-12409: RCE-Schwachstelle aufgrund einer schlechten Standardkonfiguration in Apache Solr Die Versionen 8.1.1 und 8.2.0 von Apache Solr enthalten unsichere Einstellungen in der mitgelieferten Standardkonfigurationsdatei solr.in.sh. Die Einstellungen, die zu dieser Schwachstelle führen, sin...

Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers

Cybersecurity researchers have disclosed details of a vulnerability in Amazon Kiro, an artificial intelligence AI-powered, agentic integrated development environment IDE, that could facilitate data exfiltration via prompt injection and Kiro Powers. The security flaw, which does not have a CVE...

CVE-2024-52301-Research

CVE-2024-52301-Forschung Ein wenig Recherche zu CVE-2024-52301. Ich habe die Schwachstelle gesehen und wollte herausfinden, wie Laravel angreifbar ist. Dazu habe ich einfach die Versionen 6.20.44 und 6.20.45 verglichen und nachvollzogen, wie GET-Parameter letztendlich die Anwendungskonfiguration...

Mitigate-CVE-2023-46747

Playbook Ansible per mitigare CVE-2023-46747 K000137353: Vulnerabilità di esecuzione di codice remoto non autenticata nell'utility di configurazione BIG-IP CVE-2023-46747 Ecco il link https://my.f5.com/manage/s/article/K000137353 Come utilizzarlo 1. Clona il mio repository con Git...

CVE-2022-43332

CVE-2022-43332 Cross Site Scripting in WonderCMS Descrizione: Una vulnerabilità di cross-site scripting XSS in Wondercms v3.3.4 consente a potenziali attaccanti di eseguire script web arbitrari o HTML tramite un payload appositamente creato iniettato nel campo Site title del Pannello di...

CVE-2026-76230

A flaw was found in Renovate. This vulnerability, a command injection, exists within the npm manager due to improper sanitization of user-provided package names. An attacker with write access to a repository can exploit this by crafting malicious Renovate configuration files. This allows them to...

CVE-2026-81743 Flowintel Arbitrary Log File Path Allows Remote Code Execution via Template Injection

Affected versions of Flowintel allow the LOGFILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this configurable value, an administrator could set LOGFI...

CVE-2026-81743

Flowintel versions >=3.3.0 allow the LOG_FILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this value, an attacker with high privileges can set LOG_...

web-traffic-generator

web-traffic-generator A quick and dirty HTTP/S "organic" traffic generator. About Just a simple poorly written Python script that aimlessly "browses" the internet by starting at pre-defined ROOTURLS and randomly "clicking" links on pages until the pre-defined MAXDEPTH is met. I created this as a...

YellowKey-BitLocker-CVE-2026-45585

YellowKey BitLocker YellowKey BitLocker Recovery Tool esegue il backup delle chiavi di ripristino BitLocker e controlla la CVE-2026-45585 su Windows 10/11. Le ricerche per bitlocker yellowkey , yellowkey bitlocker , yellowkey github e yellowkey vulnerability portano qui. CLI + GUI portatili per i...

CVE-2026-81662 Flowintel Alert Settings Configuration Allows Remote Code Execution via Arbitrary Configuration Keys

Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines in conf/configmodule.py. The vulnerabl...

CVE-2026-81662

Flowintel (versions ≥3.3.0 ) is vulnerable to Remote Code Execution via its alerts settings update endpoint. The root cause is improper handling of requester-supplied configuration keys: while values were normalized to Python literals, the keys themselves were injected directly into the source of...

CVE-2026-81662 Flowintel Alert Settings Configuration Allows Remote Code Execution via Arbitrary Configuration Keys

Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines in conf/configmodule.py. The vulnerabl...

CVE-2026-81573

If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers. An attacker can read potentially...

CVE-2026-31431-exploit

CVE-2026-31431 WARNUNG Diese Linux-LPE-Exploit-Implementierungen sind zur Laufzeit destruktiv. Sie überschreiben die Live-Page-Cache-Ansicht privilegierter Ziele wie: su PAM-Konfigurationsdateien jede Datei, die im patch-Modus übergeben wird Dies ist normalerweise keine dauerhafte Änderung auf de...

CVE-2025-56801

CVE-2025-56801 Schwachstelle bei der AES-CFB-IV-Erzeugung in der Reolink-Desktop-Anwendung 1. Überblick Name : Reolink-Desktop-Anwendung Version : 8.18.12 Anbieter : Reolink CWE : CWE-1204: Erzeugung eines schwachen Initialisierungsvektors IV, CWE-321: Verwendung eines fest verdrahteten...

CVE-2023-5043

CVE-2023-5043 L'iniezione di annotazioni in Ingress nginx causa l'esecuzione arbitraria di comandi 1. Creare un Ingress può essere creato senza Service e Pod root@kitploit: apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: ingress-exploit annotations: kubernetes.io/ingress.class:...

CVE-2026-29597

CVE-2026-29597: Controllo degli accessi improprio DDSN Interactive cm3 Acora CMS versione 10.7.1 contiene una vulnerabilità di controllo degli accessi improprio. Un utente con privilegi di editor può accedere a file di configurazione sensibili forzando la navigazione dell'endpoint...

CVE-2026-69097

A flaw was found in GitPython. This vulnerability allows an attacker to inject malicious configuration directives into Git configuration files by using specially crafted submodule names. This can lead to remote code execution, enabling the attacker to run unauthorized commands on the affected...