cve-2024-38819

CVE-2024-38819 01. File-Traversal and Webflux Overview 1 File-Traversal and WebFlux Overview File-Traversal Path Traversal vulnerability allows an attacker to bypass file system permissions in a web application and access arbitrary files, and is a type of attack designated as CWE-22. Spring...

riscv-isa-sim

Spike RISC-V ISA Simulator About Spike, the RISC-V ISA Simulator, implements a functional model of one or more RISC-V harts. It is named after the golden spike used to celebrate the completion of the US transcontinental railway. Spike supports the following RISC-V ISA features: RV32I and RV64I ba...

ScubaGear

!GitHub Releasegithub-release-imgrelease !PSGallery Releasepsgallery-release-imgpsgallery !CI Pipelineci-pipeline-imgci-pipeline !Functional Testsfunctional-test-imgfunctional-test !GitHub Licensegithub-license-imglicense !GitHub Downloadsgithub-downloads-imgrelease !PSGallery...

WebMvc.fn/WebFlux.fn - Path Traversal

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application...

Spring Framework Path Traversal in Functional Web Frameworks

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application...

device-modeling-language

Device Modeling Language The Device Modeling Language DML is a domain-specific language for writing fast functional or transaction-level device models for virtual platforms. DML provides high-level abstractions suitable for functional device models, including constructs like register banks,...

Web3Bugs

Demystifying Exploitable Bugs in Smart Contracts This project aims to provide a valuable resource for Web3 developers and security analysts by facilitating their understanding of exploitable bugs in smart contracts. We conduct a thorough analysis of exploitable bugs extracted from code4rena and...

resilience4j

= Fault tolerance library designed for functional programming :author: Robert Winkler and Bohdan Storozhuk :icons: :toc: macro :numbered: 1 ifdef::env-github :tip-caption: 💡 :note-caption: ℹ️ :important-caption: ❗ :caution-caption: 🔥 :warning-caption: ⚠️ endif::...

CVE-2018-17463

CVE-2018-17463 Completed a working exploit for CVE-2018-17463 for fun. The original writeup that I found on this bug was here http://phrack.org/papers/jitexploitation.html. I just really wanted to change this arb r/w into a fully working exploit. Also I learned the JIT spray technique from the...

hcon2026hwctf

Hardware Hacking CTF hcon2026hwctf If you’re into hardware CTFs, here’s the first public challenge from HC0N CTF 2026 featuring RISC-V RP2350 exploitation challenges low level We’ve tried to make the challenge not too elitist or difficult, so that the hundreds of conference participants have a...

cve_2025_20265

PoC for CVE-2025-20265 Advisory ⚠️ WARNING This is a functional exploit for a 1-day vulnerability. It can execute code on vulnerable systems. Use only on your own internal servers you are authorized to test. Unauthorized use is illegal and unethical. Use at your own risk. You are responsible for...

CVE-2025-48384-PoC

CVE-2025-48384-PoC This is not functional yet...

cve-2024-38819-lab

CVE-2024-38819 Customer Vault Lab This is a Cloud Foundry-ready Spring Boot demo for CVE-2024-38819, a Spring Framework path traversal vulnerability in functional static resource handling. What Is Patched? CVE-2024-38819 is patched in Spring Framework , not directly in Spring Boot. Spring Boot is...

CLEANSTART-2026-GG04244 Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE)

Security vulnerability affects the apache-hive package. Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE...

Understanding Post-Quantum Cryptography Adoption: Practices, Challenges, and Evolution in Open-Source Software

Post-quantum cryptography PQC standards establish algorithms for quantum-safe systems, but empirical evidence about how software projects implement and maintain PQC support remains limited. We investigate this implementation and maintenance work by mining 114,361 commits and 5,713 issues across 1...

Uncovering Why LLMs Fail: From Internal Mechanisms to Adversarial Reasoning Trajectories

Large language models LLMs are usually evaluated by final-output correctness or safety, yet an endpoint label does not reveal how a failure develops throughout the reasoning process. We therefore ask whether ordinary reasoning failures and adversarially induced failures can be characterized using...

Drupal Webform resource management error vulnerability

Drupal Webform versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1 contain a resource management error vulnerability stemming from improper interaction frequency control, which may lead to functional abuse...

HiddenLens: A Multi-Layer LLM Framework for Detecting and Resolving Hidden Assumptions in Software Requirements

Natural-language software requirements often omit assumptions about performance, operating conditions, user behaviour, and domain constraints, affecting architecture, testing, and deployment. If undiscovered until implementation, resolving them is far more costly than addressing them early...

Security Bulletin: Multiple vulnerabilties in IBM Rational Functional Tester / DevOps Test UI

Summary Multiple vulnerabilities addressed in DevOps Test UI in version 11.0.9 Vulnerability Details CVEID:CVE-2026-33671 DESCRIPTION: Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service ReDoS when...

EUVD-2026-98081

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access control...