CVE-2024-33901-ProofOfConcept

CVE-2024-33901-ProofOfConcept 用于演示 KeePassXC 2.7.7 中 CVE-2024-33901 漏洞的简短程序 该报告可能需要在类中附上源代码链接，所以我才创建了这个仓库 如何复现该漏洞 1. 打开 KeePassXC 并认证数据库 2. 在数据库已认证的情况下，为其创建内存转储文件 这可以通过获取 PID 来实现，可以使用以下命令获取 PID： ps aux | grep keepassxc 然后运行以下命令：sudo gcore -o keepassxcdump PIDHERE 例如，如果你获取到的 PID 是 1234，那么命令应为： sud...

AlmaLinux 9.2 [TuxCare] Security Update: memcached / memcached-devel / memcached-selinux (ALMALINUX9.2:CLSA-2026:1783635895)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783635895 advisory. - In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon ...

Flask-AppBuilder Has No Rate Limiting on Login AUTH DB

ImpactLack of rate limiting will allow an attacker to brute-force user credentials. PatchesAbility to enable rate limiting on Flask-AppBuilder = 4.3.0. Use AUTHRATELIMITED = True and RATELIMITENABLED = True set the limit itself by using AUTHRATELIMIT. Will apply only to database authentication...

PYSEC-2026-1380 Flask-AppBuilder Has No Rate Limiting on Login AUTH DB

Impact Lack of rate limiting will allow an attacker to brute-force user credentials. Patches Ability to enable rate limiting on Flask-AppBuilder = 4.3.0. Use AUTHRATELIMITED = True and RATELIMITENABLED = True set the limit itself by using AUTHRATELIMIT. Will apply only to database authentication...

Security update for memcached

This update for memcached fixes the following issues CVE-2026-47783: timing side-channel in SASL password database authentication username bsc1265873. CVE-2026-47784: timing side-channel in SASL password database authentication password bsc1265881. Patch Instructions: To install this SUSE update...

CVE-2026-47784

In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by saslserveruserdbcheckpass...

UBUNTU-CVE-2026-47784

In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by saslserveruserdbcheckpass...

CVE-2026-47784: Observable Timing Discrepancy

In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by saslserveruserdbcheckpass...

USN-8136-2: Dovecot regression

USN-8136-1 fixed vulnerabilities in Dovecot. The update caused a regression on Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that Dovecot incorrectly handled invalid base64 SASL data. An...

CVE-2026-24031

Dovecot SQL based authentication can be bypassed when authusernamechars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear authusernamechars. If this is not possible, install latest fixed version. No publicly available exploits...

CVE-2026-24031

Dovecot SQL based authentication can be bypassed when authusernamechars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear authusernamechars. If this is not possible, install latest fixed version. No publicly available exploits...

Improper Access Control

flaskappbuilder is vulnerable to improper access control. The vulnerability is due to the password reset endpoint remaining accessible when using OAuth, LDAP, or other non-database authentication methods, which allows an attacker to reset passwords and create valid JWT tokens even for disabled us...

Siemens TeleControl Server Basic 访问控制错误漏洞

Siemens TeleControl Server Basic is an industrial remote controller from Siemens Germany. An access control error vulnerability exists in Siemens TeleControl Server Basic versions V3.1.2.2 through prior to V3.1.2.3, which originates from an unauthenticated, remote attacker being able to obtain a...

EUVD-2008-1818

Malware in sbrugna...

EUVD-2025-16576

Malicious code in bioql PyPI...

EUVD-2022-1268

Malicious code in bioql PyPI...

CVE-2025-58065

Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface...

CVE-2025-58065

Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface...

CVE-2025-58065 Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods

Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface...

CVE-2025-58065 Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods

Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface...