hackspacecon-2023

HackSpaceCon Workshop- & Vortragsfolien Ich habe alle Slide-Decks von HackSpaceCon erfasst, die ich bekommen konnte. Falls du Zugang zu einigen hattest, die ich nicht aufgenommen habe, füge sie bitte per Pull Request hinzu! Vielen Dank!...

CVE-2026-64677 Anki's local HTTP server is vulnerable to directory traversal attacks

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...

CVE-2026-64677

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...

CVE-2026-64677

Anki’s local HTTP server (prior to version 25.09.3) is vulnerable to directory traversal via unconstrained media and built-in data paths. Attackers could leverage scripts served from shared decks or malicious sites with an origin-check bypass to read local files. The issue is fixed in 25.09.3. Af...

MAL-2025-48876 Malicious code in test-mlw2-perms-inurn-lores-decks (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in test-mlw2-perms-inurn-lores-decks (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in test-mlw1-perms-inurn-lores-decks (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-43703

An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the internal API even though the attacker has no knowledge of an API key through approaches such as scripts or the SRC attribute of an IMG element. NOTE: this issue exists...

Nextcloud: Access Control: Inject tasks into other users decks

When moving a task to another deck a request is made to /apps/deck/cards/XXXX. in the request the destination stackId parameter is used. When a user changes the parameter to that of a stack not belonging to him the task is still added. PoC Create a card: POST /apps/deck/cards HTTP/1.1...

hearthstonetopdecks.com XSS vulnerability

Vulnerable URL: https://www.hearthstonetopdecks.com/cards/?st=" autofocus onfocus=alert/OPENBUGBOUNTY/ Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:| 27.07.2017 22:42 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1482...