CVE-2018-7600-Drupalgeddon2-RCE

CVE-2018-7600 Drupalgeddon2 — Progetto Red Team Dipartimento Cybersecurity ITSOLERA | Tirocinio Offensive Security 2026 Panoramica Questo progetto analizza, replica e documenta CVE-2018-7600 Drupalgeddon2 — una vulnerabilità critica CVSS 9.8 di Remote Code Execution non autenticata nel CMS Drupal...

libsodium

Sodium is an easy-to-use software library that provides a wide range of cryptographic operations including encryption, decryption, digital signatures, and secure password hashing. It is a portable, cross-compilable, installable, and packageable fork of NaCl. While maintaining API compatibility,...

GHSA-575R-357H-FHCH Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update

Impact The API endpoint for updating asset maintenance records allows an authorized user to change the assetid of an existing maintenance record to an asset outside their company scope. In a Full Multiple Company Support / multi-company deployment, this allows a user from Company A to attach or...

Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update

Impact The API endpoint for updating asset maintenance records allows an authorized user to change the assetid of an existing maintenance record to an asset outside their company scope. In a Full Multiple Company Support / multi-company deployment, this allows a user from Company A to attach or...

CVE-2026-23010-CCSDS-Telecommand-Replay-Without-Sequence-Number

CVE-2026-23010 – Replay dei telecomandi CCSDS senza numero di sequenza Codice del programma simulatore satellite Python root@kitploit: satellitesim.py - Spacecraft that executes telecommands without checking sequence number class Satellite: def initself: self.executed = set def receivetcself,...

GHSA-35CR-9HQQ-P2MG Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint

Impact A user with the reports.view permission can delete pending checkout acceptance records by global ID, even when the acceptance belongs to an asset in another company. The report listing page appears to scope visible unaccepted assets, but the delete endpoint directly looks up...

Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint

Impact A user with the reports.view permission can delete pending checkout acceptance records by global ID, even when the acceptance belongs to an asset in another company. The report listing page appears to scope visible unaccepted assets, but the delete endpoint directly looks up...

CVE-2026-23005-Matter-Commissioning-Code-Brute-Force-Without-Rate-Limit

CVE-2026-23005 – Brute Force del Codice di Commissioning Matter senza Rate Limit Codice del Programma simulazione Python Matter root@kitploit: mattercommissioningsim.py import random realcode = random.randint10000000, 99999999 def attemptjoincodeattempt: Simulate joining: no delay, no lockout if...

GHSA-W7QW-5WFV-GWX9 Snipe-IT has CSS Injection via `header_color` Setting

Impact Because default.blade.php is the base layout loaded on every authenticated page, all active user sessions are affected immediately upon the next page load after the payload is saved. An attacker who has compromised an admin account or who is a malicious insider can use this to silently...

Snipe-IT has CSS Injection via `header_color` Setting

Impact Because default.blade.php is the base layout loaded on every authenticated page, all active user sessions are affected immediately upon the next page load after the payload is saved. An attacker who has compromised an admin account or who is a malicious insider can use this to silently...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in Babel (@babel/helpers) (CVE-2025-27789)

Summary A ReDoS and performance degradation vulnerability in Babel CVE-2025-27789 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading @babel/helpers to versions 7.27.4 and 7.29.2. Vulnerability Details CVEID:CVE-2025-27789 DESCRIPTION: Babel is a compiler for writing next...

CVE-2026-23001-Hugging-Face-Transformers-Model-Deserialization-Arbitrary-Code-via-Pickle-

CVE-2026-23001 – RCE da deserializzazione dei modelli Hugging Face Transformers Panoramica I modelli Hugging Face salvati con torch.save utilizzano la serializzazione pickle di Python, che è intrinsecamente non sicura. Se un utente scarica un modello apparentemente legittimo da un repository, il...

CVE-2025-8110

CVE-2025-8110 – PoC RCE per Gogs ≤ 0.13.3 Proof-of-Concept per CVE-2025-8110 , una scrittura arbitraria di file autenticata in Gogs ≤ 0.13.3 causata da una gestione impropria dei link simbolici nell'API PutContents. Un utente autenticato può eseguire il commit di un symlink che punta a .git/confi...

poc-CVE-2026-23489

POC CVE-2026-23489 Prova di concetto per la CVE-2026-23489 del plugin "Fields" di GLPI --cookie-value COOKIEVALUE GLPI session cookie value --php PHP Raw PHP to execute on the server end statements with ';', Dropdowns...

CVE-2026-81849

amazon-ssm-agent prior to version 3.3.4515.0 contains a path traversal vulnerability in its aws:downloadContent plugin. The root cause is an improper limitation of a pathname to a restricted directory, allowing an authenticated remote user with restricted ssm:SendCommand permission (limited to th...

CVE-2026-81849 Path traversal in the aws:downloadContent plugin in amazon-ssm-agent

Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before 3.3.4515.0 might allow an authenticated remote user whose ssm:SendCommand permission is restricted to the AWS-DownloadContent document, to write arbitrary files outside the...

CVE-2026-81849 Path traversal in the aws:downloadContent plugin in amazon-ssm-agent

Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before 3.3.4515.0 might allow an authenticated remote user whose ssm:SendCommand permission is restricted to the AWS-DownloadContent document, to write arbitrary files outside the...

EUVD-2026-67855

Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before 3.3.4515.0 might allow an authenticated remote user whose ssm:SendCommand permission is restricted to the AWS-DownloadContent document, to write arbitrary files outside the...

Snipe-IT vulnerable to directory traversal in displaySig

Impact The displaySig action in ActionlogController serves signature image files from a private upload directory. The filename parameter from the HTTP route is concatenated directly into a filesystem path with no sanitization, allowing an authenticated attacker to traverse outside the intended...

GHSA-C6F4-WJ38-M3G3 Snipe-IT vulnerable to directory traversal in displaySig

Impact The displaySig action in ActionlogController serves signature image files from a private upload directory. The filename parameter from the HTTP route is concatenated directly into a filesystem path with no sanitization, allowing an authenticated attacker to traverse outside the intended...