CVE-2023-22515

CVE-2023-22515: Confluence Data Center & Server 権限昇格脆弱性分析レポート 1. 概要 Overview CVE-2023-22515 は、Atlassian Confluence Data Center および Server 製品で発見された深刻な Critical Broken Access Control 脆弱性です。攻撃者は認証されていない状態でリモートからサーバーの初期設定プロセスを再活性化し、それによって新しい管理者アカウントを作成してシステムを完全に掌握できます。 CVE ID : CVE-2023-22515 CVSS...

framework_base_AOSP10_r33_CVE-2020-0391

此存储库没有 README。...

Cusimanse

Cusimanse 状态：Beta — 研究框架与运行时工具包 Cusimanse 正在积极开发中。Fork 它、测试它、运行参考实验、报告 bug 并提交 pull request。 在 beta 期间，API、配方、文档和集成预计会不断演进。 AI 使用与负责任贡献： Cusimanse 在其研究框架、文档、分析工作流和工程流程中使用 AI 辅助开发和智能体 AI。AI 生成或 AI 辅助的输出并不自动具有权威性、安全性、正确性、原创性或适用于生产环境。贡献者有责任在提交前审查、测试和验证 AI 辅助的更改。不要将 AI 系统作为安全决策、授权、证据解读或安全关键操作的唯一权威。仅将...

kit-policy

kit-policy Kit向けの柔軟で構成可能な認可フレームワーク。RubyのAction Policyにインスパイアされています。 TOC ファイル ファイル| 説明 ---|--- .editorconfig| エディタのフォーマット設定 .gitignore| ビルド成果物と依存関係のGit無視ルール .tool-versions| asdfツールバージョン（Zig, Kit） LICENSE| MITライセンスファイル README.md| このファイル examples/blog-policy.kit| ブログ認可の例 kit.toml|...

koyane-framework

Koyane-Framework :: ワードリスト生成・分析ツールキット 初期段階 | | / /| |\ \ / / / \ | \ | || | | || \ / \ | / || || | | || || | | / / | |/ / | | | | \ V / / /\ | | || | | | | |/ // /\ | . . || | | | | || | | || |/ /| |/ / | \ | | | | \ / | || . || | ||| | | / | || |/| || | | |/| || | | || / | \ | |\ \ / / |...

spring4shell-local-verification-lab

Spring4Shell 本地影响条件验证、修复与复测项目 项目简介 本项目用于学习和验证 Spring Framework CVE-2022-22965，也就是 Spring4Shell 漏洞的影响条件、风险表现、修复方法和修复后复测流程。 项目在个人搭建的本地授权环境中完成。项目重点不是对真实目标进行攻击，而是通过搭建修复前和修复后的 Spring MVC 测试环境，逐项确认漏洞相关影响条件，并使用安全、可控的只读方式观察 Spring 数据绑定内部属性路径在版本升级前后的差异。 本项目完成了以下流程： JDK、Maven 和 Apache Tomcat 环境准备 Spring MV...

CVE-2025-68664

CVE-2025-68664 这一切我想在圣诞节得到的就是你们的秘密：LangGrinch 袭击了 LangChain 核心 CVE-2025-68664 作者：亚尔登·波拉特 Cyata 研究：LangChain 中的 LangGrinch 漏洞 已发布：https://cyata.ai/blog/langgrinch-langchain-core-cve-2025-68664/ 昨天，LangChain 发布了一个关于我在 langchain-core 中发现的漏洞的关键警告：CVE-2025-68664 / GHSA-c67j-w6g6-q2cm。...

Cacti 1.2.24 - SQL Injection

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graphview.php. Since guest users can access graphview.php without authentication by default, if guest users are being utilized in an enabled state, there...

CVE-2026-106489 Backstage: Improper authorization enforcement for TechDocs static content

Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper authorization enforcement for techdocs static content. An authenticated user with access to one TechDocs documentation site could craft a URL able ...

DEBIAN-CVE-2026-105242

Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Reading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A...

CVE-2026-105242 Apache log4net: Request validation failure drops the event in the aspnet-request converter

Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Reading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A...

CVE-2026-105242

The Apache log4net logging framework (versions 1.2.11 through 3.5.0 ) is vulnerable to an Improper Handling of Exceptional Conditions (CWE-755) in the aspnet-request pattern converter. When reading request parameters, certain content—such as markup—triggers ASP.NET request validation , causing th...

CVE-2026-105242 Apache log4net: Request validation failure drops the event in the aspnet-request converter

Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Reading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A...

CVE-2026-106107

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering paths interpolated ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides this value with attacker-controll...

CVE-2026-106106

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env,...

CVE-2026-106103

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project...

CVE-2026-106104

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR passed an unbounded User-Agent request header to getMatch in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated...

CVE-2026-106105

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM without explicitly applying owner-only...

CVE-2026-87890

A flaw was found in Django. When handling spatial lookups in its Geographic Information System GIS framework, raster data supplied as raw bytes is processed without proper encapsulation. If an application passes untrusted input into these lookups, an attacker can supply crafted data referencing...

CVE-2026-106109 Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external...