345623 matches found
GHSA-GXMJ-R5RF-GGWQ elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
Summary elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command ZIP decompression...
elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
Summary elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command ZIP decompression...
GHSA-9HJF-W35W-6VX2 elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections
Summary The PHP connector's CSRF gate protects many mutating commands, but it does not protect the netmount connector command. In the shipped minimal connector setup, FTP network mounting is enabled by default, so a cross-site request can force an elFinder instance to mount an attacker-chosen FTP...
elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections
Summary The PHP connector's CSRF gate protects many mutating commands, but it does not protect the netmount connector command. In the shipped minimal connector setup, FTP network mounting is enabled by default, so a cross-site request can force an elFinder instance to mount an attacker-chosen FTP...
CVE-2025-9074
CVE-2025-9074: Docker Engine API 무인증 원격 코드 실행 RCE 심각도 : CRITICAL | CVSS 점수 : 9.8 추정 | 영향받는 버전 : Docker Desktop 4.44.3 CVE-2025-9074에 대한 개념 증명POC 익스플로잇으로, Docker Engine API의 무인증 원격 코드 실행RCE 취약점을 통해 권한 있는 컨테이너 탈출과 호스트 시스템 장악을 허용합니다. 🔴 취약점 개요 CVE-2025-9074는 적절한 인증이나 네트워크 격리 없이 Docker Engine API를 노출하...
block-copyfail
block-copyfail CVE-2026-31431"Copy Fail"에 대한 개념 증명 런타임 완화 — algifaead의 authencesn 암호화 템플릿을 통한 Linux 커널 권한 상승 취약점입니다. 모듈 블랙리스트와 달리 재부팅이 필요 없습니다. BPF LSM 프로그램이 socketbind를 후킹하여 Copy Fail이 악용하는 하위 시스템인 모든 AFALG AEAD 바인드를 차단합니다. 이는 암호화 템플릿 중첩예: pcryptauthencesn...을 통한 우회를 방지합니다. 다른 AFALG 사용hash,...
Important: Red Hat Security Advisory: kpatch-patch-5_14_0-570_116_1, kpatch-patch-5_14_0-570_17_1, kpatch-patch-5_14_0-570_39_1, kpatch-patch-5_14_0-570_66_1, and kpatch-patch-5_14_0-570_94_1 security update
An update for multiple packages is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
Security Bulletin:Vulnerabilities exists in NPS of IBM Netezza Appliance
Summary Vulnerabilities identified in NPS of IBM Netezza Software have been addressed in version 11.3.1.3-IF3. Vulnerability Details CVEID:CVE-2026-15816 DESCRIPTION: A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs...
Important: Red Hat Security Advisory: kpatch-patch-5_14_0-687_10_1 security update
An update for kpatch-patch-5140-687101 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
Important: Red Hat Security Advisory: kpatch-patch-4_18_0-553_109_1, kpatch-patch-4_18_0-553_125_1, kpatch-patch-4_18_0-553_53_1, kpatch-patch-4_18_0-553_72_1, and kpatch-patch-4_18_0-553_85_1 security update
An update for multiple packages is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
Important: Red Hat Security Advisory: kpatch-patch-6_12_0-211_16_1 security update
An update for kpatch-patch-6120-211161 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
Important: Red Hat Security Advisory: kpatch-patch-5_14_0-427_100_1, kpatch-patch-5_14_0-427_113_1, kpatch-patch-5_14_0-427_126_1, kpatch-patch-5_14_0-427_68_2, and kpatch-patch-5_14_0-427_84_1 security update
An update for multiple packages is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code
Manifold Security has disclosed eight security flaws across seven command-line AI coding agents in which a repository's own Git configuration names a command that the agent runs on the developer's machine, four of them still unpatched at publication. The command executes as the user, outside the...
Important: Red Hat Security Advisory: kpatch-patch-5_14_0-284_117_1, kpatch-patch-5_14_0-284_134_1, kpatch-patch-5_14_0-284_148_1, kpatch-patch-5_14_0-284_158_1, and kpatch-patch-5_14_0-284_172_1 security update
An update for multiple packages is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
CVE-2026-39987-Lab
CVE-2026-39987 — marimo 사전 인증 터미널 WebSocket RCE 실습 환경 marimo의 CVE-2026-39987을 재현하고 이해하기 위한 로컬 전용 Docker 실습 환경입니다. 이 프로젝트는 취약한 marimo 서비스와 패치된 marimo 서비스를 나란히 비교한 다음, 최소 피해 증명 스크립트를 사용하여 차이를 보여줍니다. 요약 CVE-2026-39987은 반응형 Python 노트북 프레임워크인 marimo 의 심각한 사전 인증 원격 코드 실행 취약점입니다. 취약한 동작은 터미널 WebSocket...
msdt-follina
MS-MSDT "Follina" 공격 벡터 John Hammond | 2022년 5월 30일 악성 Microsoft Word 문서로 "Follina" MS-MSDT 공격을 생성하고 HTTP 서버로 페이로드를 스테이징합니다. 사용법 root@kitploit: usage: follina.py -h --command COMMAND --output OUTPUT --interface INTERFACE --port PORT options: -h, --help show this help message and exit --command...
Drupal_REST-RCE_Unauthenticated
CVE-2019-6340 — Drupal RESTful веб-сервисы RCE Реализация на Python эксплойта удаленного выполнения кода для CVE-2019-6340, основанная на анализе модуля Metasploit и предыдущей работы leonjza. Ключевое отличие от EDB-46459: использует POST вместо GET, обходя кеш страниц Drupal — может быть выполн...
K000162521: BIG-IP and BIG-IQ Configuration utility vulnerability CVE-2026-66842
Security Advisory Description BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to the Configuration utility. CVE-2026-66842 Impact This vulnerability may allow an authenticated attacker with networ...
etaHEN
etaHEN — универсальный активатор Homebrew 🚀 Поддержите проект Если вы находите этот проект полезным и хотите поддержать его дальнейшее развитие, подумайте о том, чтобы угостить меня кофе! Сборка из исходников Исходный код предоставлен в папке Source code под лицензией GPLv3 со всеми необходимыми...