CVE-2021-21123-PoC-Google-Chrome

📝 설명 Google Chrome - File System Access API - Maciej Pulikowski가 보고한 취약점 총 버그 바운티 보상: $5.000 다음은 개념 증명PoC입니다: Google SecuritySeverity CVE 높음 CVE-2021-21123 중간 CVE-2021-21129 중간 CVE-2021-21130 중간 CVE-2021-21131 중간 CVE-2021-21172 낮음 CVE-2021-21141 주요 보안 문제는 Google Chrome이 실행하는 운영 체제 대화 상자 "Save as"...

CVE-2022-0337-PoC-Google-Chrome-Microsoft-Edge-Opera

🤝 サポートを表示 - 気に入ったら⭐️をお願いします | Twitterでシェア | フォローはこちら CVE-2022-0337 システム環境変数漏洩 Google Chrome, Microsoft Edge, Opera 📝 説明 この脆弱性を悪用されると、システム環境変数に保存されたユーザーの秘密情報が漏洩する可能性があります。Chromium 92 バージョンで発見され、97 バージョンで修正されたセキュリティバグです。ChromiumエンジンをベースにしたWebブラウザ（Google Chrome、Microsoft...

Jenkins-CVE-2024-23897

Jenkins CVE-2024-23897 PoC CVE-2024-23897에 대한 개념 증명PoC으로, Jenkins의 내장 명령줄 인터페이스CLI의 임의 파일 읽기 취약점입니다. 인증되지 않은 공격자가 Overall/Read 권한을 가지고 Jenkins 컨트롤러 파일 시스템에서 임의 파일을 읽을 수 있습니다. 영향받는 버전 Jenkins 버전 = 2.441 Jenkins LTS 버전 = 2.426.2 취약한 인스턴스 설정 docker compose를 사용하여 로컬 취약한 인스턴스를 실행합니다: root@kitploit: cd...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in File System Access in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in WebKit2GTK

The issue was resolved by improving access restrictions to the file system. This issue is fixed in Safari 18.3, iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, and visionOS 2.3. A maliciously crafted webpage may be able to obtain user fingerprints...

USN-8732-1 minetest vulnerability

It was discovered that Minetest did not properly sanitize the Lua sandbox environment when using LuaJIT. A malicious mod could escape the sandbox to execute arbitrary code and gain full file system access on the server. An attacker could use this issue to compromise the server...

CVE-2026-85149 Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SFTP service credentials of the SmartIT Agent application from the source code, thereby browsing the file system of the user's host...

The vulnerability of the File System Access component in Google Chrome and Microsoft Edge web browsers allows a perpetrator to compromise data integrity.

The vulnerability of the File System Access component in Google Chrome and Microsoft Edge is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially crafted HTML page...

The vulnerability of the File System Access component in Google Chrome and Microsoft Edge web browsers allows attackers to gain access to confidential data and compromise data integrity.

The vulnerability of the File System Access component in Google Chrome and Microsoft Edge is related to lack of access control. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data and influence data integrity through a specially created PDF file...

EUVD-2026-67161

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

CVE-2024-20767-Adobe-ColdFusion

CVE-2024-20767-Adobe-ColdFusion Adobe ColdFusion è una piattaforma di sviluppo rapido per creare e distribuire applicazioni web e mobili. CVE-2024-20767 - Le versioni di ColdFusion 2023.6, 2021.12 e precedenti sono affette da una vulnerabilità di Controllo Accesso Inadeguato che potrebbe portare...

EUVD-2026-65621

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in File System Access in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. Chromium security severity: High...

CVE-2026-73429 vulnerabilities

Vulnerabilities for packages: yazi...

CVE-2026-73429 vulnerabilities

Vulnerabilities for packages: yazi...

VulnCheck KEV: CVE-2020-9771

This issue was addressed with a new entitlement. This issue is fixed in macOS Catalina 10.15.4. A user may gain access to protected parts of the file system...

GHSA-M65R-RPRJ-R5RG vulnerabilities

Vulnerabilities for packages: yazi...

CVE-2026-72593

The CVE-2026-72593 entry concerns dulldusk/phpfm up to version 1.8.0, where a missing authentication flaw permits an unauthenticated remote attacker to access the full file management capabilities (read, write, delete, upload) on the server filesystem. The root cause is an authentication check in...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the construction of HTTP request URLs due to unescaped variable path components. An attacker can manipulate the URL to access unintended API endpoints or resources by supplying specially crafted repository or...

CVE-2026-54218

CVE-2026-54218 affects Tobit Laboratories AG TeamDavid’s Webbox. The issue stems from use of a hard-coded cryptographic key and password storage across locally created users in David, where passwords are stored in various files using only obfuscation. If an attacker can access the server’s file s...