CVE-2024-9466

CVE-2024-9466 CVE-2024-9466 概念验证 PoC 描述 该脚本通过将 /home/userSpace/devices/debug.txt 附加到目标URL或IP地址列表来检查CVE-2024-9466漏洞。它根据HTTP响应状态码以及请求是否被重定向来判断目标是否存在漏洞。 设置 确保在与脚本相同的目录中存在一个 targets.txt 文件。该文件应包含要检查的URL或IP地址列表，每行一个。例如： http://example.com http://192.168.1.1...

CVE-2024-57778

CVE-2024-57778 描述 ：Orbe ONetView Roteador Onet-1200 中的一个问题允许远程攻击者通过将服务器响应从状态码 500 提升至状态码 200 来实现权限提升。 版本 ：发现于 Orbe ONetView Roteador Onet-1200 Orbe 1680210096，但适用于所有版本。 概念验证 当访问路由器的菜单页面 http://192.168.1.1/menu.html 并点击任意选项时，将显示 500 错误码： 之后，我们可以激活 Burp Suite 来捕获应用程序的响应。然后，再次访问...

GHSA-2P9G-X3CV-5HH4 Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups

Impact The several endpoints could leak object existence information to users who had no access to it by HTTP status code 403 instead of 404. Patches https://github.com/WeblateOrg/weblate/pull/19971 References Thanks to Yaohui Wang for reporting this via GitHub...

EUVD-2015-1370

Malware in sbrugna...

EUVD-2018-4242

Malware in sbrugna...

EUVD-2021-2069

Malware in sbrugna...

EUVD-2013-2449

Malware in sbrugna...

EUVD-2013-0610

Malware in sbrugna...

EUVD-2013-2812

Malware in sbrugna...

EUVD-2023-3224

Malicious code in bioql PyPI...

EUVD-2025-29112

Malicious code in bioql PyPI...

CVE-2023-46906

juzaweb = 3.4 is vulnerable to Incorrect Access Control, resulting in an application outage after a 500 HTTP status code. The payload in the timezone field was not correctly validated...

CVE-2021-38384

Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character, which might cause a developer to implement incorrect access control, because the actual behavior within the Amazon AWS environment is a 200 HTTP status code i.e., possibly greater than expected...

Insertion Of Sensitive Information Into Log File

github.com/elastic/beats is vulnerable to Insertion Of Sensitive Information Into Log File. The vulnerability is caused due to logging the raw event object in the WARN and ERROR level if the ingesting failed with any 4XX HTTP status code except 409 or 209. This can lead to insertion of sensitive ...

GHSA-93P6-9CXV-5RPQ juzawebCMS Incorrect Access Control vulnerability

juzaweb = 3.4 is vulnerable to Incorrect Access Control, resulting in an application outage after a 500 HTTP status code. The payload in the timezone field was not correctly validated...

CVE-2023-46906

juzaweb = 3.4 is vulnerable to Incorrect Access Control, resulting in an application outage after a 500 HTTP status code. The payload in the timezone field was not correctly validated...

Improper access control

juzaweb = 3.4 is vulnerable to Incorrect Access Control, resulting in an application outage after a 500 HTTP status code. The payload in the timezone field was not correctly validated...

CVE-2023-46906

juzaweb = 3.4 is vulnerable to Incorrect Access Control, resulting in an application outage after a 500 HTTP status code. The payload in the timezone field was not correctly validated...

CVE-2023-46906

juzaweb = 3.4 is vulnerable to Incorrect Access Control, resulting in an application outage after a 500 HTTP status code. The payload in the timezone field was not correctly validated...

Default credentials

An issue was discovered by Elastic whereby Beats and Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsearch failed with any 4xx HTTP status code except 409 or 429. Depending on the nature of the event that Beats or Elastic Agent...