227402 matches found
MiniPlasma-Runner
MiniPlasma-Runner Versione modificata di Nightmare-Eclipse/MiniPlasma CVE-2020-17103 adattata per uso C2. Il PoC originale funziona solo da disco. Questa versione viene eseguita interamente in memoria tramite execute-assembly, con un approccio binario suddiviso per evitare il rilevamento...
CVE-2024-27673
CVE-2024-27673 ASUS Control Center Express = 01.06.15 - Caminho de Serviço Sem Aspas Descrição: ASUS Control Center Express Versão = 01.06.15 contém um caminho de serviço sem aspas que permite que atacantes escalem privilégios para o nível de sistema. Supondo que os atacantes tenham acesso de...
CVE-2023-51467-EXPLOIT
CVE-2023-51467 - Bypass dell'autenticazione di Apache OFBiz Questa falla consente agli attaccanti di bypassare l'autenticazione, portando a uno sfruttamento di Server-Side Request Forgery SSRF. Quando si invia una richiesta web al percorso specifico...
CVE-2026-67204
BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a...
CVE-2026-13212
The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtioisr drivers/virtio/virtiocommon.c, the device-written vq-used-ringidx.id is used directly as an index into vq-recvcbs and vq-desc, which are both allocated with exact...
CVE-2026-59230
Apache Camel's camel-mail component (MimeMultipart data format) is vulnerable to header injection when headersInline is explicitly set to true. During unmarshalling, MIME headers from the incoming message are copied onto the Camel Exchange via setHeader without a HeaderFilterStrategy, allowing a ...
CVE-2026-76071
CVE-2026-76071: تجاوز سعة مخزن مؤقت مكدسي غير مُصادَق عليه قبل المصادقة عبر sscanf %^, في معالج ipFilterList في skkset.cgi في Netis NC63 الباحث: أوزجان إرسان @ozcanpng حالة الإفصاح CVE: CVE-2026-76071 البائع: Netis Systems Co., Ltd. المنتج: راوتر Netis NC63 AC1200 اللاسلكي ثنائي النطاق جيجابت...
CVE-2024-25832-PoC
CVE-2024-25830 e CVE-2024-25832 - Controllo degli accessi improprio e caricamento di file senza restrizioni in DataCube3. Panoramica Questo repository presenta un Proof of Concept PoC per una catena di exploit in due fasi che prende di mira i dispositivi DataCube3. Combina CVE-2024-25830 Controll...
EUVD-2026-64925
The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtioisr drivers/virtio/virtiocommon.c, the device-written vq-used-ringidx.id is used directly as an index into vq-recvcbs and vq-desc, which are both allocated with exact...
CVE-2026-13212
The Zephyr RTOS virtio driver contains an out-of-bounds read in virtio_isr() (drivers/virtio/virtio_common.c). The device-written descriptor-chain head id from the used ring is used directly as an index into recv_cbs[] and desc[] without a bounds check. A malicious or compromised virtio backend (...
CVE-2026-67204
BookStack before 26.05.4 contains a broken access control vulnerability in the Image Gallery API endpoints . The API controller loads any image type without the content-type restrictions enforced by the web controller's gallery and drawio checks. An authenticated user with image-update or image-d...
EUVD-2026-64919
BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a...
CVE-2026-67204 BookStack < 26.05.4 Broken Access Control via Image Gallery API
BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a...
grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default
A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation...
grafana: Grafana: Privilege escalation via dashboard overwrite
A flaw was found in Grafana. A user with editor privileges can overwrite a dashboard not owned by them, leading to privilege escalation on that specific dashboard. This allows the editor to gain administrative control over the affected dashboard...
kernel: selinux: fix overlayfs mmap() and mprotect() access checks
A flaw was found in the Linux kernel's SELinux security module when handling overlayfs. The existing security model for overlayfs does not properly enforce access controls for mmap and mprotect operations. This oversight could allow a local attacker to bypass intended security policies, potential...
CVE-2026-9728
CVE-2026-9728 is a time-of-check/time-of-use (TOCTOU) race condition in the Zephyr RTOS userspace mailbox subsystem. The syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validates msg->data/msg->size by reading them directly from live userspace memory, then forwards the o...
CVE-2025-67888
CVE-2025-67888 Vulnerabilidade de Injeção de Comandos do SO no Control Web Panel = 0.9.8.1208 admin/index.php Versões Afetadas: Versão 0.9.8.1208 e versões anteriores. Descrição da Vulnerabilidade: A entrada do usuário passada por meio do parâmetro GET "key" para /admin/index.php quando o parâmet...
CVE-2026-78372
RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with private entities through several web views and API endpoints. The...
CVE-2026-78370
RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to remain private. The /export/ endpoint permits selected internal databases to be exported without requiring authentication. While...