142819 matches found
CVE-2026-17615
A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...
CVE-2026-17615
CVE-2026-17615 is an XML External Entity (XXE) vulnerability in RESTEasy's SourceProvider component. The root cause is that SourceProvider.writeTo() creates a SAXParser without disabling external entity resolution. An unauthenticated attacker can exploit this by sending a specially crafted XML bo...
CVE-2026-17615 Resteasy-core: resteasy sourceprovider remote unauthenticated file read
A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...
CVE-2026-17615
A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...
CVE-2026-17615 Resteasy-core: resteasy sourceprovider remote unauthenticated file read
A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...
EUVD-2026-68654
A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...
spring-retry-toolkit
This project provides declarative retry support for Spring applications. It is used in Spring Batch, Spring Integration, and others. Imperative retry is also supported for explicit usage. Version The version fix spring-retry with 2.0.13 for java8 and spring4 or spring5, For more information, plea...
CVE-2024-38472
Apache HTTP Server Windows の SSRF 脆弱性 CVE-2024-38472 に対して Remote Code Execution RCE Metasploit モジュールを作成するのは困難です。SSRF 自体は直接 RCE にはつながらないからです。ただし、SSRF は多くの場合 RCE 達成へのステップとなり得ます。特に、内部サービスとの対話や二次的な脆弱性の発動に利用できる場合です。 SSRF 経由の RCE 戦略 RCE を SSRF 経由で達成するには、通常以下が必要です。 1. SSRF 経由で悪用可能な特定の攻撃に対して脆弱な内部サービス。 2...
Cross-site Scripting (XSS)
Overview org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing an...
Cross-site Scripting (XSS)
Overview org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing an...
Cross-site Scripting (XSS)
Overview org.apache.wicket:wicket-extensions is a rich component library for the Wicket framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the AjaxEditableLabel, AjaxEditableChoiceLabel, and AjaxEditableMultiLineLabel rendering paths in...
Cross-site Scripting (XSS)
Overview org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing an...
Cross-site Scripting (XSS)
Overview org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing an...
Cross-site Scripting (XSS)
Overview org.apache.wicket:wicket-extensions is a rich component library for the Wicket framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS through org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions in the palette option-rendering...
CVE-2025-6019-exploit
CVE-2025-6019：通过UDisks2文件系统调整大小的权限提升漏洞 漏洞详情 CVE ID ：CVE-2025-6019 影响 ：本地权限提升 LPE 受影响系统 ：存在漏洞udisks2版本的Linux系统 机制 ：文件系统调整大小期间的竞争条件允许访问位于全局可写临时目录中的SUID二进制文件 关键组件 ： udisks2服务（DBus接口） org.freedesktop.UDisks2.Filesystem.Resize方法 /tmp/blockdev下的临时挂载点 利用流程 1. 准备恶意文件系统镜像（攻击者） root@kitploit: dd...
WindowsSpyBlocker
概要 WindowsSpyBlocker 🛡️ は、Go で書かれ、単一の実行可能ファイル として配布される、Windows システム上のスパイ行為やトラッキングをブロックするアプリケーションです。 このプロジェクトのアプローチは、一連のツールに基づいてネットワークトラフィックをキャプチャし解釈することです。サービス間の相互作用やトラフィックの送信元・送信先に応じて、ルールが作成され、割り当てによって分類されます。 ドキュメントとダウンロード ドキュメントとダウンロードは https://crazymax.dev/WindowsSpyBlocker/ にあります。 貢献...
unzip_poc
CVE-2022-0529 と CVE-2022-0530 unzip 6.0 の POC CVE-2022-0529 & CVE-2022-0530 https://bugzilla.redhat.com/showbug.cgi?id=2051402 https://bugzilla.redhat.com/showbug.cgi?id=2051395...
keepass_poc
CVE-2022-0725 KeePass CVE-2022-0725 的概念验证（PoC） 复现步骤： 步骤1：在终端窗口中运行 "journalctl -f"。 步骤2：在KeePass中双击一个密码。 步骤3：等待清除超时触发。 实际结果： 在终端窗口中看到明文字密码被记录。 预期结果： 在任何地方都不应看到明文字密码被记录。 参考： https://bugzilla.redhat.com/showbug.cgi?id=2052696 注意：漏洞仅存在于KeePass中，不存在于KeePassXC和其他软件包中。...
CVE-2020-26217
説明 XStreamはリモートコード実行に使用される可能性があります 影響 Xstream com.thoughtworks.xstream xstream 1.4.13 使用方法 root@kitploit: 0 text/plain 0 -1 1 cmd /c/st...
Awesome-CVE-2020-0601
すごいCVE-2020-0601一覧 ✔ 😂 CVE-2020-0601に関する厳選されたリポジトリの素晴らしいリストです。 PoC Ruby ollypwn/CVE-2020-0601 https://github.com/ollypwn/cve-2020-0601 Python kudelskisecurity/chainoffools https://github.com/kudelskisecurity/chainoffools...