Mythic-Macro-Generator

Mythic-Macro-Generator Mythic JXA 페이로드를 실행하기 위한 MS Office 매크로를 생성하는 Python3 스크립트입니다. 이 스크립트는 osascript를 사용하여 Mythic JXA .js 페이로드를 다운로드하고 실행하는 Office 매크로를 생성합니다. 단계: 1. Mythic C2 서버를 설정하고 "apfell" jxa 페이로드를 생성합니다 참고: 이 생성기는 페이로드가 http를 사용한다고 가정합니다. 만약 https를 사용하는 경우 생성기 스크립트에서 curl이 https를 사용하도록...

CVE-2023-3009

CVE-2023-3009 アイテム名における格納型XSS - TeamPass 3.0.9 における CVE-2023-2516 のバイパス - M Nadeem Qazi 著 説明 このリポジトリは、nilsteampassnet/teampass アプリケーションで発見され、CVE-2023-2516...

CVE-2023-2591

CVE-2023-2591: Teampass 3.0.6 のアイテムラベルにおける格納型HTMLインジェクション - M Nadeem Qazi 私は最近、人気のあるパスワード管理ツールである nilsteampassnet/teampass にセキュリティ脆弱性を発見しました。この脆弱性は CVE-2023-2591...

Academy LMS 6.0 - Cross-Site Scripting

Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting XSS vulnerability through query parameter. id: CVE-2023-38964 info: name: Academy LMS 6.0 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Creative Item Academy LMS 6.0 was discovered to...

CVE-2025-56771

설명 ecodotempo.com.br 웹사이트 분석 중 저장형 크로스 사이트 스크립팅Stored XSS 취약점이 발견되었습니다. 이 취약점은 공격자가 악성 스크립트를 입력 필드에 삽입하여 적절한 살균sanitization 없이 다른 사용자에게 렌더링되도록 하며, 특히 인증되지 않은연결 해제된 영역의 홈 페이지에서 발생합니다. 영향을 받는 엔드포인트 ecodotempo.com.br/colecoes/itens/cadastrarrealizar.php 영향을 받는 매개변수 name="nome" and name="descricao"...

libfwsi

libfwsi 是一个用于访问 Windows Shell Item 格式的库。 项目信息： 状态：实验性 许可证：LGPL-3.0-or-later 更多信息请参阅： 项目文档：https://github.com/libyal/libfwsi/wiki/Home 如何从源码构建：https://github.com/libyal/libfwsi/wiki/Building...

duckdb

Jepsen DuckDB 테스트 DuckDB 데이터베이스를 위한 Jepsen 테스트입니다. 원격 클러스터가 아닌 로컬에서 실행됩니다. 테스트는 로컬에서 DuckDB 파일을 열고 STDIN/STDOUT을 통해 상호작용하는 로컬 프로세스 집합을 생성합니다. 이것은 초기 프로토타입입니다. 켜지고, 트랜잭션을 실행하고, 올바른지 확인하고, 버그를 보고하지만, 그 버그가 실제인지 확실하지 않습니다. 설치 JDK21+, Git, Gnuplot, Graphviz, 그리고 Leiningen이 필요합니다. 대부분의 Jepsen 테스트와 달리 ...

CVE-2026-16148

CVE-2026-16148 affects the ITE it82xx2 USB device-controller driver in Zephyr RTOS (drivers/usb/udc/udc_it82xx2.c). The root cause is that k_work_init_delayable() is called inside it82xx2_enable(), which unconditionally overwrites the delayable work structure without a busy check . Because it82xx...

Astra Linux – Vulnerability in poppler-22

A vulnerability in Outline.cc for Poppler prior to version 23.06.0 allows a remote attacker to cause a Denial of Service DoS attack through a crafted PDF file using the OutlineItem::open method...

CVE-2026-81566

Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The add-to-menu routine invoked the commenus item model's save method directly. That model does not perform authorisation itself, because the relevant checks reside in...

CVE-2026-81566

SP Page Builder (Free and Pro, versions 4.0.0 – 6.9.0 ) for Joomla contains a missing access control vulnerability in its add-to-menu routine. The routine invoked the com_menus item model's save() method directly, bypassing the authorization checks that normally reside in the com_menus controller...

CVE-2026-81566 Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0

Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The add-to-menu routine invoked the commenus item model's save method directly. That model does not perform authorisation itself, because the relevant checks reside in...

CVE-2026-81566 Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0

Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The add-to-menu routine invoked the commenus item model's save method directly. That model does not perform authorisation itself, because the relevant checks reside in...

EUVD-2026-77385

Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The add-to-menu routine invoked the commenus item model's save method directly. That model does not perform authorisation itself, because the relevant checks reside in...

ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE

ServiceNow AI Platform Brazil, Australia, Zurich, and Yokohama releases before patching contains a pre-authentication remote code execution vulnerability. The /assessmentthanks.do endpoint passes the sysparmassessabletype parameter into GlideRecord's addQuery, which evaluates "javascript:" prefix...

CVE-2026-84645

CVE-2026-84645 — Jenkins PersistenceRoot 逆シリアライゼーション RCE SECURITY-3972 2026-09-02 に修正された Jenkins の逆シリアライゼーション脆弱性の PoC advisory。任意の単一ジョブに対して Item/Configure 権限を持つ低権限アカウントが、これを Jenkins OS ユーザーとしての任意コード実行に昇格させることができます。...

Linux Distros Unpatched Vulnerability : CVE-2026-89738

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: at91udc: drain polled-VBUS timer/work before udc is freed In polled-VBUS mode board.vbuspin && board.vbuspolled, probe arms a self-restarting cycle...

CVE-2026-89737

In the Linux kernel, the following vulnerability has been resolved: usb: typec: thunderbolt: Disable work before freeing tbt on remove tbtaltmoderemove drops the plug and cable references without draining tbt-work. The work function dereferences those references, and can also requeue itself in it...

CVE-2026-89712

In the Linux kernel, the following vulnerability has been resolved: NFSD: restart sscexpireumount walk after dropping nfsdssclock nfsd4sscexpireumount walks nn-nfsdsscmountlist with listforeachentrysafeni, tmp, .... For each expired entry it sets nsuibusy = true, drops nfsdssclock to run mntput o...

CVE-2026-68528

Concrete CMS RSS Displayer block below version 9.5.3 rendered remote feed item titles without HTML escaping, resulting in stored cross-site scripting. An attacker able to control a title in a syndicated feed could execute script in the site origin for any visitor to the affected page, including...