globalprotect-ca-cert-ipc

c2us.exe - Запускает команду от имени пользователя, под которым выполняется процесс, в сеансе рабочего стола вошедшего в систему пользователя. В данном случае запускает cmd.exe от имени SYSTEM в сеансе рабочего стола непривилегированного пользователя. c2us.c - Исходный код для c2us.exe...

CVE-2020-15215-Discord-POC

Discord Electron ISO Boundary Validation PoC Область применения Этот репозиторий представляет собой проверочный стенд концептуального доказательства PoC для укрепления границ Electron в настольных архитектурах в стиле Discord. Он моделирует разделение процессов рендеринга и основного процесса,...

android-badbinder-demo

CVE-2019-2215 Bad Binder — Analyse de l'exploit Ce dépôt est un petit projet de test pour étudier la vulnérabilité CVE-2019-2215 Bad Binder et écrire un prototype fonctionnel d'exploit pour Android avec une interface graphique simple en Kotlin/Jetpack Compose. Dans ce README, je : 1. Décris la...

CVE-2021-1366

CVE-2021-1366 Élévation de privilèges locale de Cisco AnyConnect Posture HostScan : CVE-2021-1366 Une vulnérabilité dans le canal de communication interprocessus IPC de Cisco AnyConnect Secure Mobility Client pour Windows pourrait permettre à un attaquant local authentifié d'effectuer une attaque...

NotCVE-2026-0010

Сводка Уязвимость: Неаутентифицированное повышение локальных привилегий до SYSTEM через TCP-порт 24801 демона Barrier Вендор: debauchee проект Barrier Продукт: Barrier 2.4.0 финальный выпуск, 01.11.2021 CWE: CWE-306: Отсутствие аутентификации для критической функции Описание Служба Windows Barrie...

CVE-2026-2796-and-CVE-2026-2768-escape-the-wasm-box

CVE-2026-2796 + CVE-2026-2768 — Побег из Wasm-песочницы Исследование полной цепочки эксплуатации Firefox: путаница типов в WebAssembly для выполнения кода в renderer-процессе , объединённая с багом родительского процесса для побега из песочницы. Обе ошибки исправлены в Firefox 148 MFSA-2026-13;...

sdwan-cve-2021-1480

Exploit for CVE-2021-1480 SD-WAN Материалы PoC для эксплуатации CVE-2021-1480 на Cico SD-WAN. Полная публикация доступна на сайте XMCO : https://blog.xmco.fr/wp-content/uploads/2021/08/XMCO-SDWANReport-CVE-2021-1480.pdf Использование: 1. Обновите строки 173 и 176, чтобы задать uid текущего...

CVE-2026-100640

SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote...

CVE-2026-100634

SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process app/electron/main.js. The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows,...

CVE-2026-100640 SiYuan before v3.8.4 Clipboard Data Disclosure via IPC

SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote...

CVE-2026-100640 SiYuan before v3.8.4 Clipboard Data Disclosure via IPC

SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote...

CVE-2026-100640 SiYuan before v3.8.4 Clipboard Data Disclosure via IPC

SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote...

CVE-2026-100634 SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows

SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process app/electron/main.js. The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows,...

CVE-2026-100634

SiYuan versions before v3.8.4 are vulnerable to a flaw in the 'siyuan-send-windows' IPC handler within the Electron main process (app/electron/main.js). The handler fails to validate the sender or restrict recipients, forwarding payloads to every BrowserWindow via BrowserWindow.getAllWindows(), i...

EUVD-2026-87728

SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process app/electron/main.js. The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows,...

CVE-2026-100634 SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows

SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process app/electron/main.js. The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows,...

CVE-2026-100634 SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows

SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process app/electron/main.js. The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows,...

CVE-2026-100634: Missing Authorization

SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process app/electron/main.js. The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows,...

EUVD-2026-86337

Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote...

CVE-2026-93405: Improper Neutralization of Input During Web Page Generation

Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote...