89 matches found
chepy
Chepy Chepy is a python library with a handy cli that is aimed to mirror some of the capabilities of CyberChef. A reasonable amount of effort was put behind Chepy to make it compatible to the various functionalities that CyberChef offers, all in a pure Pythonic manner. There are some key advantag...
swift-nio-ssh
SwiftNIO SSH このプロジェクトは、SwiftNIO を使用したSSHサポートを含んでいます。 SwiftNIO SSHとは？ SwiftNIO SSHは、SSHのプログラムによる実装です。つまり、プログラマがSSHを話すエンドポイントを実装できるようにするAPIのコレクションです。重要なのは、これはopensshというよりlibssh2に近いということです。SwiftNIO SSHは本番環境ですぐ使えるSSHクライアントやサーバを提供するのではなく、そのようなクライアントとサーバを構築するための構成要素を提供します。...
CVE-2026-71518
CVE-2026-71518 — Typemill の未認証認可バイパス パス等価な URL バリアントがロール制限付きメディアのダウンロードをバイパス 制限は生のリクエストパスに基づいて判定される一方、ファイルは OS 解決後のパスから読み込まれる — その2つは一致しない 概要 · サマリー · 根本原因 · 攻撃チェーン · エクスプロイト · 対策 · タイムライン 📋 概要 🔎 サマリー Typemill では、管理者が media/files/filerestrictions.yaml...
gimphash
gimphash gimphash は、Go バイナリ向けの imphash 相当値を計算するための提案手法です。その名前は G o-imp ort-hash に由来します。 Golang バイナリは、依存関係を実行可能ファイルの一部として含んでいます。これらの依存関係には標準ライブラリのパッケージとサードパーティの依存関係の両方が含まれ、従来の imphash と同様に、Golang プロジェクトを識別するために使用できます。 依存関係は、各 Golang バイナリに含まれる pclntab を使用して列挙できます Mandiant によるこのブログ記事も参照してください。pclnta...
Astra Linux – Vulnerability in libgit2
A issue was discovered in libgit2 before versions 0.28.4 and 0.9x before version 0.99.0. The checkout.c file mishandles equivalent filenames that exist due to NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353...
Astra Linux – Vulnerability in libgit2
A issue was discovered in libgit2 before versions 0.28.4 and 0.9x before version 0.99.0. path.c improperly handles equivalent filenames that exist due to NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352...
CVE-2026-19423: Improper Privilege Management
The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the site's registered role names rather than against the form's own allow-list, allowing unauthenticated...
CVE-2026-70496 Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestwork
A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control RBAC configurations, approve Certificate Signing Requests CSRs, and manage ManifestWork. This grants...
CVE-2026-72901: Improper Neutralization of Special Elements used in an OS Command
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy allows an authenticated low-privilege member to execute arbitrary commands on the control-plane host because the volumeName field accepted by volumeBackup.create and volumeBackup.runManually is interpolated...
JLSEC-2026-1135 Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input...
Issue Summary: Cryptographic Message Services CMS processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve...
CVE-2026-64445 staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth OnAuth has two bugs in the shared-key authentication path. When the Privacy bit is set, rtwwepdecrypt is called without verifying that the frame is long enough t...
SUSE CVE-2026-34182
Issue Summary: Cryptographic Message Services CMS processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve...
CVE-2026-34182
Issue Summary: Cryptographic Message Services CMS processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve...
AZL-89931 CVE-2026-34182 affecting package openssl for versions less than 3.3.7-3
Issue Summary: Cryptographic Message Services CMS processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve...
CVE-2026-34182: Improper Validation of Integrity Check Value
Issue Summary: Cryptographic Message Services CMS processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve...
PT-2026-47831
Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description Cryptographic Message Services CMS processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers. This allows attackers to achiev...
CVE-2026-43968: Improper Neutralization of CRLF Sequences
Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in ninenines cowlib allows SSE event splitting and injection via unvalidated field values. cowsse:event/1 in cowlib guards the id and event fields against \n but not against bare \r, and the internal prefixlines/2 function...
`unpack_in` can chmod arbitrary directories by following symlinks
In versions 0.6.0 and earlier of astral-tokio-tar, the unpackin API could inadvertently modify the permissions of external i.e. non-archive directories outside of the archive. An attacker could use this to contrite a tar archive that maliciously changes directory permissions outside of its intend...
PT-2026-26429
Name of the Vulnerable Software and Affected Versions Spring Boot versions prior to 4.0.3 Spring Boot versions prior to 3.5.11 Spring Boot versions prior to 3.4.15 Description Spring Boot applications utilizing the Actuator feature may be susceptible to an authentication bypass issue. This occurs...
