quiver

Quiver : A Meta-Tool for Kali Linux Quiver is an organized namespace of shell functions that pre-fill commands in your terminal so that you can ditch your reliance on notes, copying, pasting, editing, copying and pasting again. Quiver helps you remember how to use every tool in your arsenal and...

CVE-2024-28397-js2py-Sandbox-Escape

소개 中文 js2py는 파이썬 인터프리터 내에서 자바스크립트 코드를 평가할 수 있는 인기 있는 파이썬 패키지입니다. 다양한 웹 스크래퍼가 웹사이트의 자바스크립트 코드를 파싱하는 데 사용합니다. js2py 내 전역 변수 구현에 취약점이 존재하며, 이를 통해 공격자는 js2py 환경에서 파이썬 객체에 대한 참조를 얻을 수 있습니다. 결과적으로 공격자는 js 환경을 벗어나 호스트에서 임의의 명령을 실행할 수 있습니다. 일반적으로 사용자는 js2py.disablepyimport를 호출하여 자바스크립트 코드가 js2py 환경을 벗어나는...

CVE-2026-18937

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-18937 CVE-2026-18937 Broken Link Checker 2.4.11 - wordpress.org I am @abraxasnull. Loopback lab. The client is CVE-2026-18937-Abraxas-Labs.py. Query vars become globals. On plain permalinks,...

BypassCredGuard

BypassCredGuard - Wdigest 메모리 패치를 통한 Credential Guard 우회 배경 Adam Chester @xpn가 UseLogonCredential을 활성화하고 Wdigest가 평문 자격 증명을 캐시하도록 만드는 메모리 패치에 관한 글 "Exploring Mimikatz - Part 1 - WDigest"을 작성했는데, 저는 이 글에 흥미를 느꼈습니다. LSASS 프로세스에 로드된 wdigest.dll 모듈에는 gfParameteruseLogonCredential과 gIsCredGuardEnabled...

CVE-2026-18937: Improper Control of Generation of Code

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic non-block ...

Mesop Class Pollution vulnerability leads to DoS and Jailbreak attacks

From @jackfromeast and @superboy-zjc:We have identified a class pollution vulnerability in Mesop = 0.14.0 application that allows attackers to overwrite global variables and class attributes in certain Mesop modules during runtime. This vulnerability could directly lead to a denial of service DoS...

mariadb: Arbitrary code execution via global system variable manipulation by a high-privileged user

A flaw was found in MariaDB server. A high-privileged MariaDB user could exploit this vulnerability by manipulating specific global system variables, namely wsrepsstreceiveaddress or wsrepsstdonor. This manipulation could allow the user to execute arbitrary shell commands as the user ID of the...

GO-2026-5476 Arcane: Missing admin authorization on global variables endpoint in github.com/getarcaneapp/arcane/backend

Arcane: Missing admin authorization on global variables endpoint in github.com/getarcaneapp/arcane/backend...

CVE-2026-47125 Arcane: Missing admin authorization on global variables endpoint

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.2, the PUT /api/environments/id/templates/variables endpoint, which writes the system-wide .env.global file used for variable substitution in every project's compose file, is missing an admin...

CVE-2026-47125

CVE-2026-47125 — Arcane global variables endpoint lacks admin authorization Affected: Arcane interface for Docker management (before 1.19.2) via PUT /api/environments/{id}/templates/variables that writes the system-wide .env.global. Root cause: missing admin check in the UpdateGlobalVariables han...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the PUT /api/environments/id/templates/variables endpoint. An attacker can overwrite global environment variables used in all project deployments by sending requests as an authenticated non-admin user,...

Arcane: Missing admin authorization on global variables endpoint

Summary The PUT /api/environments/id/templates/variables endpoint, which writes the system-wide .env.global file used for variable substitution in every project's compose file, is missing an admin authorization check. Any authenticated non-admin user can call this endpoint with their bearer token...

GHSA-JPJH-JM2P-39HH Arcane: Missing admin authorization on global variables endpoint

Summary The PUT /api/environments/id/templates/variables endpoint, which writes the system-wide .env.global file used for variable substitution in every project's compose file, is missing an admin authorization check. Any authenticated non-admin user can call this endpoint with their bearer token...

PT-2026-42873

Name of the Vulnerable Software and Affected Versions Arcane versions prior to 1.19.2 Description The "PUT /api/environments/id/templates/variables" endpoint, used to write the system-wide .env.global file for variable substitution in project compose files, lacks an admin authorization check. Any...

Linux Distros Unpatched Vulnerability : CVE-2026-23919

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - For performance reasons Zabbix Server/Proxy reuses JavaScript Duktape contexts used in script items, JavaScript reprocessing, Webhooks. This can lead to...

SUSE CVE-2026-23919

For performance reasons Zabbix Server/Proxy reuses JavaScript Duktape contexts used in script items, JavaScript reprocessing, Webhooks. This can lead to confidentiality loss where a regular non-super Zabbix administrator leaks data for hosts they do not have access to. A fix has been released tha...

EUVD-2026-14950

For performance reasons Zabbix Server/Proxy reuses JavaScript Duktape contexts used in script items, JavaScript reprocessing, Webhooks. This can lead to confidentiality loss where a regular non-super Zabbix administrator leaks data for hosts they do not have access to. A fix has been released tha...

CVE-2026-23919

For performance reasons Zabbix Server/Proxy reuses JavaScript Duktape contexts used in script items, JavaScript reprocessing, Webhooks. This can lead to confidentiality loss where a regular non-super Zabbix administrator leaks data for hosts they do not have access to. A fix has been released tha...

DEBIAN-CVE-2026-23919

For performance reasons Zabbix Server/Proxy reuses JavaScript Duktape contexts used in script items, JavaScript reprocessing, Webhooks. This can lead to confidentiality loss where a regular non-super Zabbix administrator leaks data for hosts they do not have access to. A fix has been released tha...

UBUNTU-CVE-2026-23919

For performance reasons Zabbix Server/Proxy reuses JavaScript Duktape contexts used in script items, JavaScript reprocessing, Webhooks. This can lead to confidentiality loss where a regular non-super Zabbix administrator leaks data for hosts they do not have access to. A fix has been released tha...