1589 matches found
CVE-2026-77393 Inductive Automation Ignition Incorrect Default Permissions
In Ignition 8.1.53 and earlier, the Gateway "Create Project Roles" setting shipped blank, which permitted any authenticated user to create projects if they can execute gateway scripts. Ignition 8.1.54 restricts project creation to Designer sessions and no longer relies on this setting. The 8.3...
fastjson-cve
Proyecto de Reproducción de CVE-2026-16723 Descripción General Este proyecto reproduce CVE-2026-16723 — una vulnerabilidad crítica de Ejecución Remota de Código RCE en fastjson 1.2.68 hasta 1.2.83. La vulnerabilidad permite RCE bajo configuración predeterminada sin requerir la habilitación de...
SCAT
SCAT Herramienta de adquisición de credenciales de HP SiteScope ¿Qué es esto? Una herramienta que abusa de una vulnerabilidad de ejecución remota de código en instalaciones predeterminadas de HP SiteScope v11.32 y otras para robar credenciales almacenadas en SiteScope. ¿Qué vulnerabilidad de...
Apache-Solr-Arbitrary-File-Read
Apache Solr Arbitrary File Read Hit Counter Apache Solr stands for Searching On Lucene with Replication is a free, open-source search engine based on the Apache Lucene library. Written in Java. Apache Solr has RESTful XML/HTTP and JSON APIs and client libraries for many programming languages such...
CVE-2026-84736
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation for outbound HTTPS connections by default. When the TLSCERTIFICATEVALIDATION environment variable is unset or set to false, the...
SUSE CVE-2026-55857
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be coerced into transmitting the account password over an insecure connection. The mysqlclearpassword plugin is gated behin...
Hadoop-YARN-RCE
RCE no autenticado en Apache Hadoop YARN ResourceManager Existe una vulnerabilidad de acceso no autorizado en Apache Hadoop YARN ResourceManager cuando su API REST puerto predeterminado 8088 o los puertos RPC están expuestos sin autenticación habilitada. De forma predeterminada, Hadoop deja las...
hekate
Hekate - Un exploit de ejecución remota de código en VMWare Workspace ONE Access Steven Seeley del Qihoo 360 Vulnerability Research Institute Servidor MySQL malicioso original de LandGrey Detalles Hekate se pronuncia heh-ka-teh Fecha: Tue Feb 22 13:37:00 CST 2022 Versión: 21.08.0.1 última Archivo...
exploit-CVE-2026-23744
exploit-CVE-2026-23744 MCPJam Inspector es una plataforma de desarrollo local-first para servidores MCP. En las versiones 1.4.2 y anteriores, una vulnerabilidad de ejecución remota de código permite a los atacantes enviar solicitudes HTTP manipuladas que instalan un servidor MCP y ejecutan código...
CVE-2026-63563
CVE-2026-63563 - Modificación no autenticada de la libreta de direcciones en impresoras multifunción Sharp MX/BP Aviso del fabricante: Aviso de seguridad de producto de Sharp 2026-004 publicado el 31 de julio de 2026 Resumen Las impresoras multifunción de la serie Sharp MX/BP exponen la libreta d...
CVE_2021_27850_POC
Usage root@kitploit: git clone https://github.com/Ovi3/CVE202127850POC.git cd CVE202127850POC/ gradlew runnbaleJar java -jar ./build/libs/CVE202127850POC-1.0-SNAPSHOT.jar Usage: java TapestryExploit Tapestry Key DNS URL java TapestryExploit Tapestry Key CB2 Command Assuming the HMAC key is change...
Lack of transparency in JFrog Artifactory
JFrog has identified a vulnerability in JFrog Artifactory. This vulnerability resides in the default configuration of JFrog Artifactory, where insufficient authentication controls are in place. As a result, an unauthenticated attacker can escalate their privileges to administrative level using...
CVE-2026-19723
The Social Media Share Buttons & Social Sharing Icons WordPress plugin (before 3.0.1 ) contains a Reflected Cross-Site Scripting vulnerability via the Pin It Share Handler . The root cause is a failure to properly escape a value taken from the incoming request before outputting it in an inline Ja...
JFrog Artifactory Improper Authentication Vulnerability
JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges...
CVE-2026-62388
A flaw was found in NLTK. The software's default settings in pathsec.py cause security checks to only issue warnings rather than actively preventing malicious actions. This allows attackers to bypass safeguards designed to prevent unauthorized access to files path traversal and the execution of...
github.com/getkin/kin-openapi: kin-openapi: kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default
A flaw was found in kin-openapi. This vulnerability allows a remote attacker to bypass authentication checks. Specifically, the system incorrectly handles missing authentication configurations, substituting them with a function that does not verify user credentials. This enables unauthorized acce...
CVE-2026-82329
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges...
CVE-2026-82329
CVE-2026-82329 is a critical authentication bypass in JFrog Artifactory (self-managed), rooted in the JFrog Access service. On default installations, a blank join key is silently trusted, and its HMAC secret is a fully known 32-byte value of 0x20. An unauthenticated attacker forges a valid join J...
CVE-2026-82329 Potential authentication bypass leading to administrative access in Artifactory
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges...
