425 matches found
elfloader
Summary elfloader is a super simple loader for ELF files that generates a flat in-memory representation of the ELF. Pair this with Rust and now you can write your shellcode in a proper, safe, high-level language. Any target that LLVM can target can be used, including custom target specifications...
CVE-2025-63589
CVE-2025-63589 Reflected XSS in CMSimpleXH index.php path handling Discovered: October 6, 2025 Products: CMSimpleXH open-source flat-file CMS Affected versions: 1.8 CVEs: CVE-2025-63589 Authentication required: None unauthenticated Attack type: Reflected Cross-Site Scripting XSS Estimated CVSS...
flatpak
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. See https://flatpak.org/ for more information. Flatpak is available in the package repositories of most Linux distributions and can be installed from there. See https://flatpak.org/setup/ for quic...
elfloader
概要 elfloader 是一个超级简单的 ELF 文件加载器，它能够生成 ELF 的扁平内存表示。 将其与 Rust 搭配使用，现在你就可以用一种合适、安全、高级的语言编写你的 shellcode。任何 LLVM 可以定位的目标架构都可以使用，包括针对真正奇特平台和 ABI 的自定义目标规格。尽情享受在 32 位系统上使用 u64、边界检查数组、内存分配的 drop 处理等功能吧 : 它只是将所有 LOAD 段串联在一起，如果存在间隙则使用零填充，形成一个大扁平文件。 该文件包含 .bss 段的零初始化，因此可以直接用作 shellcode 负载。...
CVE-2025-8714-POC
CVE-2025-8714-POC PoC de RCE en PostgreSQL — CVE-2025-8714 PoC de Ejecución Remota de Código en PostgreSQL — CVE-2025-8714 pgdump Reverse Shell Este repositorio presenta una prueba de concepto PoC para la vulnerabilidad crítica CVE-2025-8714 que afecta a versiones PostgreSQL anteriores a: 17.6,...
CVE-2024-40111-Exploit
CVE-2024-40111：Automad 2.0.0-alpha.4 中的存储型跨站脚本（XSS）漏洞 漏洞详情 漏洞标题 ：Automad 2.0.0-alpha.4 中的存储型跨站脚本（XSS）漏洞 日期 ：2024-06-20 漏洞作者 ：Jerry Thomas w3bn00b3r 厂商主页 ：Automad 软件链接 ：Automad GitHub 仓库 类别 ：Web 应用 平面文件 CMS 版本 ：2.0.0-alpha.4 测试环境 ：Docker 版本 26.1.4，Debian GNU/Linux 11 bullseye 描述 在 Automad...
CVE-2026-66780 Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity
A flaw was found in the submariner-operator component. The submariner-k8s-broker-cluster Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information...
CLSA-2026-1771546205 TuxCare security update for flat (4 CVEs)
TuxCare rebuilt flat to address 4 CVEs. Fixed in 2.0.1-tuxcare.1...
MINI-4QFP-7MC9-CWXH
Bulletin has no description...
CVE-2026-64167
CVE-2026-64167 affects the Linux kernel. The issue arises because kho_fill_kimage() unconditionally populates KHO metadata for all kexec image types, including crash kernels that run in a small reserved region. This can cause the crash kernel to fault during kho_memory_init() when it accesses a K...
PYSEC-2026-2685 OpenStack Nova calls qemu-img without format restrictions for resize
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in a...
@chaibuilder/sdk (>=0.1.0, <=1.2.19), @coderrental/csp-categorytree (>=1.1.0, <=1.1.7) +2 more potentially affected by CVE-2026-55091 via flat-to-nested (>=1.1.0, <=1.1.1)
flat-to-nested NPM version =1.1.0, =0.1.0, =1.1.0, =1.0.17, =1.0.18 - flow-dg-category-module 0.0.0 Source cves: CVE-2026-55091 Source advisory: SNYK:JS-FLATTONESTED-17817904...
@chaibuilder/sdk (>=0.1.0, <=1.2.19), @coderrental/csp-categorytree (>=1.1.0, <=1.1.7) +2 more potentially affected by CVE-2026-55091 via flat-to-nested (>=1.1.0, <=1.1.1)
flat-to-nested NPM version =1.1.0, =0.1.0, =1.1.0, =1.0.17, =1.0.18 - flow-dg-category-module 0.0.0 Source cves: CVE-2026-55091 Source advisory: OSV:GHSA-HP36-V28F-W3R4...
GHSA-HP36-V28F-W3R4 flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key
Summary convert builds the nested tree by using each flat record's id and parent field values directly as object keys, with no guard against proto / constructor / prototype. A record whose parent is the string "proto" makes tempparent resolve to Object.prototype, and the following initPush...
ROOT-APP-NPM-CVE-2020-36632 CVE-2020-36632 in @rootio/flat - Patched by Root
Root has patched CVE-2020-36632 in the @rootio/flat package for Root:npm. Multiple fixed versions available...
CVE-2026-39387
BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database. Versions prior to 2.1.3 are vulnerable to a critical Local File Inclusion LFI attack via the tpl parameter, which can lead to Remote Code Execution RCE.The application fails to...
Statamic 代码问题漏洞
Statamic is a powerful flat-file CMS built using Laravel by Statamic Inc. It allows all content, templates, assets, and settings to be stored in files rather than in a database. There were code vulnerabilities in versions prior to Statamic 5.73.22 and 6.18.1. These vulnerabilities stemmed from UR...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: clk: rs9: Fix for suspend/resume behavior. Disabling the cache in commit 2ff4ba9e3702 “clk: rs9: Fix for I2C accessors” without removing cache synchronization in the resume path results in a kernel panic, as map-cacheops is unset...
