127 matches found
CVE-2024-28995
CVE-2024-28995 SolarWinds Serv-U는 호스트 머신의 민감한 파일을 읽을 수 있게 하는 디렉터리 트래버설 취약점의 영향을 받았습니다. 설치 git clone https://github.com/gotr00t0day/CVE-2024-28995.git cd CVE-2024-28995 pip3 install -r requirements.txt 사용법 단일 대상 스캔 python3 CVE-2024-28995.py -t domain.com 도메인 목록 스캔 python3 CVE-2024-28995.py -f...
viper
This repository is archived and development of Viper 1.x is discontinued. A full refactor of the project started withViper 2. Viper is a binary analysis and management framework. Its fundamental objective is to provide a solution to easily organize your collection of malware and exploit samples a...
podman: Arbitrary file write when importing OCI archive
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...
CVE-2025-11395
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...
PT-2026-93217
Name of the Vulnerable Software and Affected Versions Podman affected versions not specified Description An issue exists where an attacker can create arbitrary files on the host machine with the privileges of the user running the software. This occurs when a specially crafted tar archive is...
Malicious code in originaldevelopmentstelemetry (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60940a80ca72863b54a3cc8f1cc7da49be77b38e9111d4cb77cfc1417671f399 The package is advertised as a telemetry utility but its sole exported function, downloadAndRunClient, downloads updater.hta from...
Malicious code in 3layerdipstack4dhmdb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db0ccaa499343ec1f18b5618c6f7e9c86899fee1d1e184e9cbf419add99187c0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
CVE-2026-72878
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy's backup and restore pipeline constructs shell commands by directly interpolating user-controlled database fields into bash -c "..." and sh -c "..." strings, then executes them via childprocess.exec. An...
CVE-2026-72878: Improper Neutralization of Special Elements used in an OS Command
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy's backup and restore pipeline constructs shell commands by directly interpolating user-controlled database fields into bash -c "..." and sh -c "..." strings, then executes them via childprocess.exec. An...
PT-2026-69923
Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description The backup and restore pipeline constructs shell commands by directly interpolating user-controlled database fields into bash -c and sh -c strings, which are then executed via the child process.exe...
CVE-2026-55115
The CVE-2026-55115 entry describes a Server-Side Request Forgery (SSRF) in the UniFi Protect Application that could allow a low-privilege, network-accessible attacker to escalate privileges on the host. The available sources state the affected component as the UniFi Protect Application and identi...
Johnson Controls CEM AC2000
ADVISORY SUMMARY Successful exploitation of this vulnerability could allow a standard user to escalate privileges on the host machine. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for...
CVE-2026-35044: Improper Neutralization of Special Elements Used in a Template Engine
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.38, the Dockerfile generation function generatecontainerfile in src/bentoml/internal/container/generate.py uses an unsandboxed jinja2.Environment with the jinja2.ext.do extensio...
CVE-2026-21765: Incorrect Permission Assignment for Critical Resource
HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys located on a Windows host machine might be subject to overly permissive file system permissions...
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine...
CVE-2025-40553: Deserialization of Untrusted Data
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication...
CVE-2025-12556
An argument injection vulnerability exists in the affected product that could allow an attacker to execute arbitrary code within the context of the host machine...
EUVD-2017-14015
Malware in sbrugna...