dsiem

Dsiem Dsiem is a security event correlation engine for ELK stack, allowing the platform to be used as a dedicated and full-featured SIEM system. Dsiem provides OSSIM-style correlation for normalized logs/events, perform lookup/query to threat intelligence and vulnerability information sources, an...

CVE-2026-72585-PoC

CVE-2026-72585 — Grafana : Correction incomplète de CVE-2026-21724 permettant au rôle Éditeur de supprimer des points de contact protégés Produit : Grafana Grafana Labs — jusqu'à 13.2.0 Fichier : pkg/services/ngalert/provisioning/contactpoints.go CWE : CWE-284 — Contrôle d'accès inapproprié CVSS...

GHSA-VX2M-JPXR-XV7W Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint

Summary Cloudreve's file-listing responses hand the client a contexthint UUID that is meant to speed up follow-up operations. When that hint is replayed on the file/url and file/thumb routes, DBFS caches a shareNavigatorState containing the already-loaded share root and share row. On a later...

silverboxcc

Red Alert V2.0 नामक रिवर्स इंजीनियर्ड एंड्रॉइड मैलवेयर। विश्लेषण के समय, कोई भी C2 सर्वर चालू नहीं था और इसलिए हम मैलवेयर और C2 सर्वर के बीच किसी भी ट्रैफ़िक का निरीक्षण करने में असमर्थ थे। इसलिए हमने C2 प्रोटोकॉल समझ लिया और यह कंट्रोल पैनल लिखा। डिवाइस से बॉट के ट्रैफ़िक को iptables का उपयोग कर...

CVE-2019-25485

🐞 CVE-2019-25485: R 3.4.4 - स्टैक-आधारित बफर ओवरफ़्लो x86 और x64 R 3.4.4 में स्टैक-आधारित बफर ओवरफ़्लो। x86 पर पूर्ण शोषण, लेकिन x64 पर केवल RIP नियंत्रण गैजेट विश्लेषण के साथ प्रोग्राम बाधाओं के कारण। दो आर्किटेक्चर पर समान कमजोरी, जो अलग-अलग शोषण पथों की ओर ले जाती है। 📑 विषयसूची यह रिपॉजिटरी...

CVE-2026-78266 WordPress AutomatorWP plugin <= 5.8.3 - Broken Access Control vulnerability

Subscriber Broken Access Control in AutomatorWP = 5.8.3 versions...

CVE-2026-78266

AutomatorWP , a WordPress plugin , is affected by a Broken Access Control vulnerability in versions ≤ 5.8.3 . The flaw allows a Subscriber -level authenticated user to perform actions beyond their expected permissions, resulting in a high integrity impact (CVSS 3.1 base score 6.5 / MEDIUM ). The ...

CVE-2026-32561 WordPress Booking Hub plugin <= 1.3.0 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Booking Hub = 1.3.0 versions...

CVE-2026-27364

Broken Access Control vulnerability in the WordPress Style Kits plugin (AnalogWP) versions ≤ 2.6.5 . A Subscriber -level authenticated user can exploit insufficient access controls, resulting in a high impact on integrity (CVSS 3.1: 6.5 MEDIUM, vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). No conf...

CVE-2026-27364 WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability

Subscriber Broken Access Control in Style Kits = 2.6.5 versions...

CVE-2026-5006

A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include...

CVE-2026-55468

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

process_overwriting

Process Overwriting Process Overwriting is a PE injection technique, closely related to Process Hollowing and Module Overloading. With its help, you can replace the main executable not a DLL of the target process. It works only for a newly created process - injection to existing processes is not...

CVE-2025-22828

CVE-2025-22828 📜 Description Apache CloudStack 4.16.0 et versions ultérieures présentent un problème de contrôle d'accès défaillant qui permet à des utilisateurs connaissant les UUID de ressources de lire ou d'ajouter des commentaires annotations sur des ressources auxquelles ils ne sont pas...

EUVD-2026-39432

3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation...

CVE-2025-39247

CVE-2025-39247 الهدف: HikCentral Professional HCMP، خادم VMS مركزي CVE: CVE-2025-39247 — ثغرة في التحكم بالوصول CVSS 3.1: 8.6 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N المتأثر: V2.3.1 – V2.6.2 و V3.0.0 المُعالَج: V2.6.3 / V3.0.1 / حزمة الإصلاح CVE-2025-39247 تاريخ الإفصاح: 2025-08-28 تاريخ التحليل:...

CVE-2026-55468 Wagtail: Improper restriction handling on Pages admin API

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

CVE-2026-55468

CVE-2026-55468 affects the internal Pages admin API in Wagtail , an open-source CMS built on Django. The API returns page fields declared in api_fields without sufficient access control , allowing any user with Wagtail admin access to retrieve restricted draft and live page content , including ba...

CVE-2026-61419

Dell ThinOS 10, versions prior to 260510.2518, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2022-1442

CVE-2022-1442 वर्डप्रेस प्लगइन Metform = 2.1.3 - अनुचित पहुँच नियंत्रण जो अप्रमाणित संवेदनशील जानकारी के प्रकटीकरण की अनुमति देता है विवरण यह /core/forms/action.php फ़ाइल में अनुचित पहुँच नियंत्रण के कारण संवेदनशील जानकारी के प्रकटीकरण के लिए असुरक्षित है, जिसका उपयोग एक अप्रमाणित हमलावर PayPal,...