CVE-2026-61800 Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding the cluster key can write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, leading to remote code executi...

CVE-2026-61800

Wazuh (open-source XDR/SIEM platform) versions 4.4.0 through 4.14.6 contain a flaw in cluster file synchronization. In the non-merged branch of update_master_files_in_worker() , staged files are moved to a destination derived only from safe_join(), which confines the path to /var/ossec but never ...

CVE-2025-46295-fix-fms

Sostituto dei JAR Apache Commons per FileMaker Panoramica Il sostituto dei JAR Apache Commons per FileMaker è una soluzione di automazione che affronta CVE-2025-46295 sostituendo i file JAR Apache Commons vulnerabili nelle installazioni di FileMaker Server. Invece di aggiornare l'intero FileMaker...

cve-2025-54505-fix

Questo repository non contiene un README...

Security Bulletin: Access Control Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-3482)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed Access Control security vulnerability. Vulnerability Details CVEID:CVE-2026-3482 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0...

Security Bulletin: Security Vulnerability in Eclipse Jetty affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-1605)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Eclipse Jetty Vulnerability Details CVEID:CVE-2026-1605 DESCRIPTION: In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP...

cp30_XXE_partial_fix

c3p0 c3p0 è una libreria matura e altamente concorrente per il pooling di connessioni JDBC, con supporto per la cache e il riutilizzo di PreparedStatements. È concessa in licenza sotto LGPL v.2.1 o EPL v.1.0, a tua scelta. c3p0 è ora mantenuto su github. c3p0 è disponibile come dipendenza gestita...

cve-2017-8529

cve-2017-8529 I miei file CVE-2017-8529 Uno script PowerShell per configurare la correzione del registro in CVE-2017-8529...

openssl-heartbleed-fix

openssl-heartbleed-fix OpenSSL Heartbleed CVE-2014-0160 Fix script Sammy Fung [email protected] Il bug OpenSSL Heartbleed CVE-2014-0160 http://www.us-cert.gov/ncas/alerts/TA14-098A è stato scoperto dai professionisti della sicurezza informatica e colpisce molti sistemi che utilizzano alcune...

reactor

Reactor Reactor è nato come fork del progetto open source ElastAlert. Il maintainer di questo progetto dovrebbe tenere d'occhio le modifiche a ElastAlert escludendo i loro alerter aggiuntivi e assicurarsi che eventuali fix di bug rilevanti vengano integrati e che qualsiasi funzionalità utile veng...

WCFDSer-ngng

WCFDSer-ngng Un plugin Burp Extender che rende leggibili e modificabili gli oggetti SOAP binari. Basato sul lavoro originale di Brian Holyfield, tutti ringraziano Brian http://blog.gdssecurity.com/labs/2009/11/19/wcf-binary-soap-plug-in-for-burp.html Perché? Questa versione corregge un bug per cu...

CVE-2021-4034

CVE-2021-4034 PoC für PwnKit: Lokale Rechteausweitungsschwachstelle in polkits pkexec in Python Verwendung root@kitploit: git clone https://github.com/rvizx/CVE-2021-4034 cd CVE-2021-4034 python3 cve-2021-4034-poc.py Hinweise C : https://github.com/arthepsy/CVE-2021-4034 Behebung root@kitploit:...

fix_nginx_CVE-2013-4547_IB

fixnginxCVE-2013-4547IB...

Internet-Security-Project---CVE-2021-26814

Internet-Security-Project---CVE-2021-26814 Progetto di Internet Security, per il mio esame all'Università di Catania, in cui puoi imparare come sfruttare una vulnerabilità di Wazuh v4.0.3 e come questa vulnerabilità può essere corretta. Link al repository originale dello script:...

n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)

Affected versions 1.0.0 Patched version 1.0.0 Description In versions prior to 1.0.0, the SQLite node accepted the database file path as a direct node parameter visible and editable in the workflow. A workflow author who mapped untrusted user input to the dbpath field could allow an attacker to...

CVE-2026-40453

Riproduttore di Iniezione di Intestazioni Camel con Variazione di Maiuscole/Minusscole CVE-2026-40453 Questo progetto dimostra CVE-2026-40453 — una correzione incompleta per CVE-2025-27636. La correzione del 2025 ha aggiunto setLowerCasetrue a HttpHeaderFilterStrategy in modo che i nomi di...

CVE-2026-47727 Trilium: RCE via `shareTemplate` relation missing `isDangerous` flag — Safe import bypass leading to EJS SSTI (Incomplete Fix of CVE-2026-45668)

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize the shareTemplate relation because that relation is not marked as dangerous, allowing an attacker-supplied import archive to plant a server-side...

CVE-2026-81722

nltk PorterStemmer in versions = 3.10.2 fixed in 3.10.3 contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem. The isconsonant helper walks backward over the entire run of trailing 'y' characters on every call, and measure invokes it for each stem position, causin...

CVE-2023-49964

CVE-2023-49964: FreeMarker Server-Side Template Injection in Alfresco In Hyland Alfresco Community Edition =7.2.0 wurde ein Problem entdeckt. Durch das Einfügen von schädlichem Inhalt in die Datei folder.get.html.ftl kann ein Angreifer SSTI-Angriffe Server-Side Template Injection durchführen, die...

python: Fix of 3 CVEs

CVE-2026-15308: fix quadratic complexity CPU DoS in the incremental HTMLParser when unterminated markup declarations span many feed calls, by accumulating new data and only rescanning once enough has piled up...