220 matches found
CVE-2018-3760
CVE-2018-3760 Уязвимость обхода каталогов в конвейере ассетов Rails Обнаружено Orange Tsai Примечание : По умолчанию Rails-приложения, работающие в production-режиме, не уязвимы к этому эксплойту. Эксплойт: curl -v...
CVE-2024-28752
Среда воспроизведения Apache CXF CVE-2024-28752 Уведомление об уязвимости: https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt Запуск среды samples/javafirstjaxwsfactorybean IDEA Запуск веб-сервиса через ServerStarter.java Сборка Используйте JDK8 mvn clean package java -jar...
thm-Moniker-Link-cve-2024-21413-writeup
TryHackMe: Moniker Link CVE-2024-21413 Путь: Cyber Security 101 → Exploitation Basics → Moniker Link CVE-2024-21413 Сложность: Premium-комната Тема: Обход Protected View в Outlook, утечка NTLM-хэшей и перехват учётных данных с помощью Responder CVE-2024-21413 — критическая уязвимость Microsoft...
CVE-2023-1177
CVE-2023-1177 | | Обход пути MLFlow | Протестировано на MLflow 2.2.0 | src: https://github.com/iumiro/CVE-2023-1177-MLFlow | .. code-block:: bash !/bin/bash RAND="EXPLOIT-$1+$RANDOM%9999" URL="http://172.17.0.2:6001" FILE='/root/.ssh/idrsa' curl -vX POST...
CVE-2026-74246
A flaw was found in Red Hat Quay's custom build trigger handler. This vulnerability allows a user with organization repository administrative privileges and the FEATUREBUILDSUPPORT enabled to read arbitrary files on the build worker. This is possible due to insufficient validation of the build...
CVE-2021-36749
CVE-2021-36749 Apache Druid произвольное чтение файлов Затронутые версии: version = 0.21.1 Можно использовать следующие два способа Командная строка curl http://127.0.0.1:8888/druid/indexer/v1/sampler?for=connect -H "Content-Type:application/json" -X POST -d...
CVE-2026-61749 InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The...
EUVD-2026-74795
Specifying tblproperties'avro.schema.url'=' http://...' or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error...
SUSE CVE-2026-84637
Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This...
EUVD-2026-69703
Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This...
Linux Distros Unpatched Vulnerability : CVE-2026-84637
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executabl...
CVE-2026-84637
Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This...
CVE-2026-84637
Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This...
UBUNTU-CVE-2026-84637
Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This...
CVE-2026-84637
A flaw was found in Thunderbird. Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows systems. This bypasses Thunderbird's built-in protections for executable attachments, potentially leading to arbitrary code execution...
CVE-2026-84637 Calendar invitation attachments could launch local executables
Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This...
CVE-2026-84637 Calendar invitation attachments could launch local executables
Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This...
CVE-2026-84637
Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This...
CVE-2026-84637
Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This...
CVE-2026-84637
In Mozilla Thunderbird , malicious calendar invitations can utilize file URI attachments to execute local or network-hosted executables on Windows systems. This technique allows attackers to bypass standard executable attachment protections and may display the attachment under a misleading filena...