200 matches found
CVE-2024-3094_xz_check
CVE-2024-3094 xz チェックスクリプト このリポジトリには、CVE-2024-3094 で指定された脆弱なバージョンの「xz」ユーティリティがシステムで実行されているかどうかを確認するための Bash スクリプトとワンライナーコマンドが含まれています。 以下の説明と影響の記述は、RedHat から入手可能な情報に基づいています https://access.redhat.com/security/cve/CVE-2024-3094: "悪意のあるコードが、バージョン 5.6.0 以降の「xz」の上流 tarball で特定されました。このコードは、liblzma...
CVE-2022-45472
CVE-2022-45472 DOMベースXSS ソフトウェア: CAE Learning Space Enterprise with Intuity License イメージバージョン: 267r パッチレベル: 639 脆弱性: DOMベースXSS 説明 CAE Learning Space Enterprise 管理ソフトウェアは、DOMベースXSS攻撃に対して脆弱です。DOMベースXSS攻撃とは、ユーザーが実行可能なペイロードをホストに送信し、その結果として、元のクライアントサイドスクリプトから被害者のブラウザ内のDOM環境を変更する攻撃です。この攻撃は、Burp...
Microsoft-Office-Word-MSHTML-Remote-Code-Execution-Exploit
Microsoft-Office-Word-MSHTML-Remote-Code-Execution-Exploit CVE-2021-40444 METASPLOITで使用するエクスプロイト。攻撃者が悪意のあるコードをファイルに注入することで、Microsoft Office Wordを介してリモートコード実行を可能にします...
CVE-2024-3094-info
CVE-2024-3094 信息 https://github.com/lockness-Ko/xz-vulnerable-honeypot https://tukaani.org/xz-backdoor/ - Lasse Collin 回应 https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27...
Malicious code in thurdweb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 775ff15f4a1314978d4cfed1e97c6c9ac8621d8ddeed93160c25aa3681f73cc7 Package name thurdweb is a one-character substitution of the popular web3 SDK thirdweb, but the shipped source is a copy of MikeMcl/big.js...
Keras 路径遍历漏洞
Keras is an open-source deep learning framework developed by Keras. Versions of Keras prior to 3.14.0 contained a path traversal vulnerability. This vulnerability stemmed from a path traversal issue in the archive extraction tool. The functions filtersafetarinfos and filtersafezipinfos used to...
Attackers adopt JavaScript runtime Bun to spread NWHStealer
In our previous research, we analyzed a Windows infostealer we track as NWHStealer. The attackers behind this stealer are continuously finding new methods to distribute the stealer. During our hunting activities, we noticed how attackers are using a JavaScript runtime called Bun to help distribut...
EUVD-2019-20087
Ask Expert Script 3.0.5 contains cross-site scripting and SQL injection vulnerabilities that allow unauthenticated attackers to inject malicious code by manipulating URL parameters. Attackers can inject script tags through the cateid parameter in categorysearch.php or SQL code through the view...
PT-2026-28466
Name of the Vulnerable Software and Affected Versions Home Assistant versions 2020.02 through 2026.01 Description Home Assistant, an open-source home automation software, contains a flaw where an authenticated user can inject malicious code into a device entity name. This allows for Cross-Site...
CVE-2026-20116 Multiple Cisco Contact Center Products Cross-Site Scripting Vulnerabilities
A vulnerability in the web-based management interface of Cisco Finesse, Cisco Packaged Contact Center Enterprise Packaged CCE, Cisco Unified Contact Center Enterprise Unified CCE, Cisco Unified Contact Center Express Unified CCX, and Cisco Unified Intelligence Center could allow an unauthenticate...
EUVD-2020-30957
Outline Service 1.3.3 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path in C:\Program Files x86\Outline to inject malicious code that would execute with...
CVE-2022-38625
Patlite NH-FB v1.46 and below was discovered to contain insufficient firmware validation during the upgrade firmware file upload process. This vulnerability allows authenticated attackers to create and upload their own custom-built firmware and inject malicious code. NOTE: the vendor's position i...
CVE-2022-26947
Archer 6.x through 6.9 SP3 6.9.3.0 contains a reflected XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the...
CVE-2021-27602
SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain modules within the application. An attacker with this authorization can inject malicious code in the...
EUVD-2021-21015
Malware in sbrugna...
EUVD-2021-1147
Malware in sbrugna...
EUVD-2018-19886
Malware in sbrugna...
EUVD-2000-0876
Malware in sbrugna...