94 matches found
CVE-2023-32571-POC
Dynamic Linq 인젝션을 통한 RCE - CVE-2023-32571 Dynamic Linq 인젝션을 통한 RCE 정보 CVE-2023-32571 최근 NCC Group의 연구원들이 Dynamic Linq에서 공격자가 Linq Injection을 통해 C 함수를 호출할 수 있는 취약점을 발견했으며, 이를 통해 RCE를 달성할 수 있게 되었습니다. Dynamic Linq에 대한 RCE 보고서에도 불구하고, NCC Group의 연구원들은 어떤 이유에서인지 명령 실행을 위한 POC를 공개하지 않았습니다. POC NCC Grou...
Astra Linux – Vulnerability in Python-Django
A issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. This issue arises due to the use of the Django Template Language’s variable resolution logic. The dictsort template filter is potentially vulnerable to information disclosure, or an unintended method call...
CVE-2026-87919 Product XML Feed Manager for WooCommerce < 3.1.1 - Contributor+ Arbitrary Product Deletion via Shortcode
The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by...
EulerOS 2.0 SP12 : avahi (EulerOS-SA-2026-2519)
According to the versions of the avahi packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any...
PT-2026-43449
Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.1 Kirby versions prior to 5.4.1 Description Kirby failed to validate model attributes used in collection queries, enabling authenticated Panel users to execute arbitrary model methods. This arbitrary method call, a...
avahi: avahi-daemon: Avahi: Denial of Service via D-Bus method call
A flaw was found in Avahi. An unprivileged local user can exploit this vulnerability by sending a D-Bus method call with conflicting publish flags. This can lead to a denial of service DoS by crashing the avahi-daemon, making the service unavailable...
OESA-2026-1983 avahi security update
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. This enables you to plug your laptop or computer into a network and instantly be able to view other people who you can chat with, find printers to print to or find files being shared...
OESA-2026-1985 avahi security update
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. This enables you to plug your laptop or computer into a network and instantly be able to view other people who you can chat with, find printers to print to or find files being shared...
CVE-2026-34933
A flaw was found in Avahi. An unprivileged local user can exploit this vulnerability by sending a D-Bus method call with conflicting publish flags. This can lead to a denial of service DoS by crashing the avahi-daemon, making the service unavailable...
AZL-81959 CVE-2026-34933 affecting package avahi for versions less than 0.8-8
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version...
UBUNTU-CVE-2026-34933
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version...
CVE-2026-34933 Avahi: Reachable assertion in `transport_flags_from_domain()` via conflicting publish flags crashes avahi-daemon
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version...
CVE-2026-34933: Reachable Assertion
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version...
django-unicorn affected by component state manipulation via unvalidated attribute access
Summary Component state manipulation is possible in django-unicorn due to missing access control checks during property updates and method calls. An attacker can bypass the intended ispublic protection to modify internal attributes such as templatename or trigger protected methods. Vulnerability...
Bitcoinrb Vulnerable to Command injection via RPC
Summary: Remote Code Execution Unsafe handling of request parameters in the RPC HTTP server results in command injection Details In lib/bitcoin/rpc/httpserver.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is...
CVE-2019-16676
Plataformatec Simple Form has Incorrect Access Control in filemethod? in lib/simpleform/formbuilder.rb, because a user-supplied string is invoked as a method call...
CVE-2025-12010 Authors List <= 2.0.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Limited Method Call in Plugin's Shortcode
The Authors List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.6.1 via the via arbitrary method call from AuthorsListShortcode class. This makes it possible for authenticated attackers, with Contributor-level access and above, to ca...
EUVD-2018-6694
Malware in sbrugna...