89 matches found
imbyter-WinRAR_CVE-2023-38831
💥 WinRAR Vulnerability Description CVE-2023-38831 A spoofable file extension vulnerability exists in WinRAR versions prior to 6.23. Attackers can exploit this vulnerability by crafting specially packaged files that appear harmless, such as JPG .jpg image files, text files .txt, or PDF documents...
backdoorppt
backdoorppt - 'Office 스푸핑 확장자 도구' root@kitploit: 버전 릴리스: v1.7-Stable 작성자: pedro ubuntu r00t-3xp10it 지원 배포판: Linux Kali, Ubuntu, Mint Suspicious-Shell-Activity© SSA RedTeam 개발 @2017 페이로드.exe를 가짜 워드 문서.ppt로 변환 root@kitploit: 간단한 스크립트로, 사용자가 기존 실행 파일.exe에 ms-word 아이콘을 추가하고resource-hacker를 백엔드 애플리케이션...
CVE-2021-21123-PoC-Google-Chrome
📝 説明 Google Chrome - File System Access API - Maciej Pulikowski 氏によって報告された脆弱性 バグ報奨金の合計: $5.000 これは、以下の脆弱性に対する Proof of Concept（概念実証）です: Google SecuritySeverity CVE 高 CVE-2021-21123 中 CVE-2021-21129 中 CVE-2021-21130 中 CVE-2021-21131 中 CVE-2021-21172 低 CVE-2021-21141 ここでの主なセキュリティ問題は、Google Chrome...
MEC
Masked Extension Control MEC Masked Extension Control MEC は、Windows がファイルを開くプログラムを拡張子だけでなくマジックナンバーに基づいて選択できるようにするプログラムです。これはシステムにとってはるかに安全です。なぜなら、多くの攻撃は拡張子を偽装して、本来ファイルを開くべきプログラムではなく、脆弱なプログラムに開かれたり実行されたりすることを試みることから始まるからです。 開発者モード 詳細については、https://mec.e-paths.com を参照してください。 偽の拡張子に基づく攻撃を防ぐ...
CVE-2023-38831-KQL
CVE-2023-38831 - WinRARファイル拡張子スプーフィングの脆弱性 説明 サイバー犯罪者は、ファイル拡張子をスプーフィングできる脆弱性を悪用しています。これは、.jpg や .txt などの一般的なファイルタイプを装ったアーカイブ内に、悪意のあるスクリプトの起動を隠すことができることを意味します。この脆弱性はRARLABとMITRE Corporationの両方に報告され、後者が識別子CVE-2023-38831を割り当てました。特筆すべきは、サイバー犯罪者がZIPアーカイブを使用して、DarkMe、GuLoader、Remcos...
CVE-2026-17998
Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. Chromium security severity: Low...
CVE-2026-17998
Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. Chromium security severity: Low...
CVE-2026-17998
Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. Chromium security severity: Low...
Linux Distros Unpatched Vulnerability : CVE-2026-13948
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension ...
Linux Distros Unpatched Vulnerability : CVE-2026-14154
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to...
Linux Distros Unpatched Vulnerability : CVE-2026-13945
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient policy enforcement in Extensions in Google Chrome on Linux prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious...
SUSE CVE-2026-8006
Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. Chromium security severity: Low...
CVE-2026-32753 FreeScout: Stored XSS through SVG file upload with filter bypass
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. In versions 1.8.208 and below, bypasses of the attachment view logic and SVG sanitizer make it possible to upload and render an SVG that runs malicious JavaScript. An extension of .png with content type of...
Linux Distros Unpatched Vulnerability : CVE-2026-3928
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient policy enforcement in Extensions in Google Chrome prior to 146.0.7680.71 allowed an attacker who convinced a user to install a malicious extension ...
CVE-2025-66548
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1.14.4, and 1.15.1, file extension can be spoofed by using RTLO characters, tricking users into download files with a different extension th...
CVE-2025-66548
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1.14.4, and 1.15.1, file extension can be spoofed by using RTLO characters, tricking users into download files with a different extension th...
EUVD-2025-201466
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1.14.4, and 1.15.1, file extension can be spoofed by using RTLO characters, tricking users into download files with a different extension th...
CVE-2025-66548 Nextcloud Deck app allows to spoof file extensions by using RTLO characters
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1.14.4, and 1.15.1, file extension can be spoofed by using RTLO characters, tricking users into download files with a different extension th...
CVE-2025-66548 Nextcloud Deck app allows to spoof file extensions by using RTLO characters
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1.14.4, and 1.15.1, file extension can be spoofed by using RTLO characters, tricking users into download files with a different extension th...
