joomla_rce_CVE-2015-8562

joomlarceCVE-2015-8562 Joomla! 3.4.6 未満のすべてのバージョンは脆弱であることが知られています。ただし、悪用が可能なのは PHP 5.5.29 未満、5.6.13 未満、および 5.5 未満のバージョンです。 デモ : https://www.youtube.com/watch?v=twqYpn1ir4o...

CVE-2026-24733

CVE-2026-24733 CVE-2026-24733とは？ Apache Tomcatは、特定のsecurity-constraint設定において、HTTP/0.9形式のHEADリクエストを誤って処理していました。 CVE-2026-24733 防御的検証ツール CVE-2026-24733 （Apache TomcatのHTTP/0.9 HEAD security-constraintバイパス）に対応する、軽量で依存関係のないPythonセキュリティ検証ツールです。 本プロジェクトは以下の用途を想定しています： ブルーチーム SOCアナリスト 脆弱性管理チーム...

maat

About Maat is an open-source Dynamic Symbolic Execution and Binary Analysis framework. It provides various functionalities such as symbolic execution, taint analysis, constraint solving, binary loading, environment simulation, and leverages Ghidra's sleigh library for assembly lifting:...

CVE-2022-3602

CVE−2022-3602 이게 뭔가요? 이 문서와 저장소는 OpenSSL의 punycode 버퍼 오버플로 문제인 CVE−2022-3602에 대한 분석입니다. '안티-POC'이 문제는 악용 가능성이 없는 것으로 보입니다로, 자체 OpenSSL 빌드를 유지 관리하는 사람들과 컴파일러 유지 관리자를 위한 것입니다. 동일 릴리스에는 별도의 CVE인 CVE-2022-3786이 있으며, 이 역시 버퍼 오버플로를 유발하지만 공격자가 그 내용을 제어할 수 없습니다. 여기에는 해당 문제에 대한 재현이 없지만, 해당 문제는 충돌로 인한 서비스...

opensource_defect_repare_cc

要件 脆弱性の発見と修正...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

CVE-2026-93601

rustls-webpki the Rust webpki fork used by rustls versions = 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a...

UBUNTU-CVE-2026-93601

rustls-webpki the Rust webpki fork used by rustls versions = 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a...

CVE-2024-43998

CVE-2024-43998 설명 CVE-2024-43998 : Blogpoet 테마에서 누락된 권한 부여 취약점으로 인해 ACL에 의해 적절히 제한되지 않은 기능에 접근할 수 있습니다. 이 문제는 Blogpoet 버전 n/a부터 1.0.3까지 영향을 미칩니다. 사용법 root@kitploit: usage: CVE-2024-43998.py -h -u URL -p PLUGIN CVE-2024-43998 exploit by Nxploited options: -h, --help show this help message and exit...

tomcat security, bug fix, and enhancement update

An update is available for tomcat. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages...

cve-2026-43515-poc

CVE-2026-43515 — Apache Tomcat 보안 제약 우회 악용 가능성 판정: 악용 가능 확인. 분할된 구성으로 보호되는 리소스에 대한 POST 요청이 인증을 완전히 우회합니다. 필요한 web.xml 형태는 표준 배포에서 흔하지 않습니다 — 자세한 내용은 분석을 참조하세요. 목차 개요 영향받는 버전 근본 원인 분석 저장소 구조 요구 사항 사용법 예상 출력 참조 면책 조항 개요 CVE-2026-43515는 Apache Tomcat의 보안 제약 평가 로직의 취약점입니다. 단일 가 동일한 URL 확장자 패턴예: .htm...

DEBIAN-CVE-2026-93601

rustls-webpki the Rust webpki fork used by rustls versions = 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a...

CVE-2026-93594

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file id. Query-execution paths that reach record data through LSM index files or the TimeSeries engine never invoke that permission check, so an...

EUVD-2026-82896

rustls-webpki the Rust webpki fork used by rustls versions = 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a...

CVE-2026-93601 rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass

rustls-webpki the Rust webpki fork used by rustls versions = 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a...

CVE-2026-93601

rustls-webpki (the Rust webpki fork used by rustls) versions ≥ 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly evaluated permitted-subtree DNS name constraints for wildcard certificates. For example, a name constraint of accept.example.com was treated as satisfied by a certificate f...

CVE-2026-93601 rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass

rustls-webpki the Rust webpki fork used by rustls versions = 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a...

CVE-2026-93601 rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass

rustls-webpki the Rust webpki fork used by rustls versions = 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a...

CVE-2026-93600 rustls webpki Name Constraints URI Validation Bypass

rustls-webpki rustls/webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are restrictions on otherwise properly issu...

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...