log4j_RCE_CVE-2021-44832

Log4j 2.17.0 RCE -- CVE-2021-44832 재현 1. 악성 jndi 서버 시작 java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -A "127.0.0.1" 2. config/log4j2.xml의 DataSource 부분을 생성된 jndi 주소로 수정 설정 파일을 자신의 HTTP 서버에 배포 3. Poc 수정 HTTP 서버에 배포된 설정 파일로 ...

KismetMobileDashboard

KismetMobileDashboard 이것은 구버전입니다. 새 Kismet은 WebSocket을 지원하므로 이런 종류의 무언가를 더 쉽게 만들 수 있습니다. 모바일 UI의 주요한 새 재작성입니다. 이상적으로는 더 테스트하고 싶지만 hackersummercamp가 코앞에 있어 시간이 부족합니다. 주요 기능 업데이트: 1. 이제 장치를 클릭하여 세부 정보를 드릴다운할 수 있습니다. 예: AP - AP 목록 - AP와 해당 클라이언트 - 클라이언트 세부 정보 2. 이제 모바일 대시보드를 통해 로그인이 가능합니다. 3. 데이터 소스...

CVE-2026-31816-rshell

CVE-2026-31816 リバースシェルエクスプロイト 概要 このツールはCVE-2026-31816を悪用して、標的のBudibaseサーバーにリバースシェル接続を確立します。 攻撃チェーン : 認証バイパス → DATASOURCEプラグインのアップロード → サーバーサイドコード実行 → リバースシェル 要件 Python 3.6以上 requestsライブラリ（pip install requests） CVE-2026-31816の影響を受ける標的Budibaseサーバー 使用方法 基本手順 1. 攻撃者マシンでリスナーを起動 nc -lvnp 4444 2...

DataEase_Postgresql_JDBC_Bypass-CVE-2025-49002

fofa構文：title="DataEase" poc: "POST /de2api/datasource/validate HTTP/1.1 Host: your-ip Accept-Encoding: gzip, deflate, br, zstd sec-ch-ua: ""Google Chrome"";v=""135"", ""Not-A.Brand"";v=""8"", ""Chromium"";v=""135"" User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like...

CVE-2026-75786

Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onwards...

EUVD-2026-90600

Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onwards...

CVE-2026-84842

IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component. An authenticated remote attacker could exploit this vulnerability to delete files and potentially cause denial of service or impact system integrity...

CVE-2026-84842 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component. An authenticated remote attacker could exploit this vulnerability to delete files and potentially cause denial of service or impact system integrity...

EUVD-2026-89188

IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component. An authenticated remote attacker could exploit this vulnerability to delete files and potentially cause denial of service or impact system integrity...

CVE-2026-84842

IBM Guardium Data Protection 12.2 is susceptible to a path traversal and arbitrary file deletion vulnerability within the Datasource REST component . An authenticated remote attacker can exploit this flaw to delete files, which may result in a denial of service or compromise system integrity . No...

CVE-2026-84842 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component. An authenticated remote attacker could exploit this vulnerability to delete files and potentially cause denial of service or impact system integrity...

CVE-2026-66083

The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata,...

EUVD-2026-88742

The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata,...

CVE-2026-66083 Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource

The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata,...

CVE-2026-66083 Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource

The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata,...

CVE-2026-66083

The Apache DolphinScheduler software (versions prior to 3.4.3 ) is vulnerable to an authorization flaw in the /datasources/unauth-datasource endpoint. An authenticated user can exploit this to access information regarding data sources they are not authorized to view. This could result in the expo...

CVE-2026-84842: Improper Limitation of a Pathname to a Restricted Directory

IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component. An authenticated remote attacker could exploit this vulnerability to delete files and potentially cause denial of service or impact system integrity...

CVE-2026-54350-Budibase-NoSQL-Injection

CVE-2026-54350 — Budibase 未認証のNoSQLオペレーターインジェクション Budibaseにおける未認証のJSON/NoSQLオペレーターインジェクション。ドキュメントデータソース（MongoDB、CouchDB、Elasticsearch、DynamoDB-PartiQL、またはJSONボディを持つREST）をバックエンドとするPUBLIC クエリを公開しているBudibaseアプリにアクセスする匿名の訪問者は、単一の未認証HTTPリクエストで、バックエンドのコレクションのすべてのドキュメントを読み取り...

Quartz-1

コンパイルするには： % mvn install -DskipTests 注意： a. 最終的なQuartz jarはquartz/targetの下にあります b. コンパイルに必要なOracleおよび/またはWeblogicのサードパーティライブラリjarがない場合 （これらはライセンスの関係で公開Mavenリポジトリには見つかりません）、メインのpom.xmlの下で該当モジュールを コメントアウトするか、必要なアーティファクトをダウンロードしてインストールできます。 Oracleの場合：ojdbc5.jarは...

GO-2026-6514 Perses's missing authorization in datasource proxy allows cross-scope secret disclosure in github.com/perses/perses

Perses's missing authorization in datasource proxy allows cross-scope secret disclosure in github.com/perses/perses...