VULNERABLE-CVE-2024-45337

VULNERABLE-CVE-2024-45337 Un proyecto de ejemplo que muestra código Go vulnerable a CVE-2024-45337. Este es un proyecto complementario de: https://github.com/NHAS/CVE-2024-45337-POC Así tienes algo que explotar. Uso root@kitploit: go run solver.go -authorised-pubkey ided25519.pub -allowed...

Malicious code in example-nodejs-express (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb2351b3777bfaea370237b22b5155a53e293162cb01bca791717b05107a4b7c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped

Summary Unescaped entity property enables Javascript injection. Details I think this is possible because %sourcelabel% in twig macro is not escaped. Therefore script tags can be inserted and are executed. PoC - clone example project https://github.com/DamienHarper/auditor-bundle-demo - create...