112192 matches found
CVE-2026-46455
CVE-2026-46455 — camel-keycloak における ISACTIVE チェックの欠落 期限切れトークンの受け入れ 同じApache Camel脆弱性に対する実行可能な概念実証PoC再現コードです。ランタイムごとに1つ用意されています: ランタイム| ディレクトリ| スタック ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-keycloak 4.18.2 Camel Quarkus| camel-quarkus/| Quarkus 3.36.0 + Camel...
SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*
Summary GHSA-c8r8-95hg-mp34 added a centralized guard, util.IsForbiddenAbsPath, specifically to block access to a small set of sensitive files: conf/conf.json plaintext accessAuthCode/API token/cookie key, data/snippets/conf.json, the entire data/templates/ directory, and...
GHSA-3CM4-CCVW-6XR6 SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*
Summary GHSA-c8r8-95hg-mp34 added a centralized guard, util.IsForbiddenAbsPath, specifically to block access to a small set of sensitive files: conf/conf.json plaintext accessAuthCode/API token/cookie key, data/snippets/conf.json, the entire data/templates/ directory, and...
CVE-2026-5865
このリポジトリには README がありません。...
CVE-2026-3910
このリポジトリには README がありません。...
CVE-2026-104971
The open-source project management tool Plane contains multiple authorization vulnerabilities affecting versions prior to 1.4.0 . The DuplicateAssetEndpoint fails to restrict FileAsset fetching to the caller's workspace, enabling cross-workspace asset duplication . Additionally, WorkspaceFileAsse...
CVE-2026-104971 Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization
Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication. WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint omit workspace authorization,...
CVE-2026-31694-POC
CVE-2026-31694: FUSE readdir 캐시 범위를 벗어난 쓰기 fs/fuse/readdir.c:fuseadddirenttocache에 경계 검사 누락이 있습니다. FUSE 서버가 namelen = 4095인 dirent를 반환하면, 이는 4120바이트 레코드로 직렬화됩니다. 커널이 이를 하나의 4096바이트 페이지 캐시 페이지에 복사하고, 서버가 제어하는 24바이트가 다음 물리 페이지로 오버플로됩니다. 이 저장소에는 쓰기 프리미티브에 대한 마커 PoC와, 오버플로를 페이지 캐시에 있는 /etc/passwd의...
cve-2017-12615
이 저장소에는 README가 없습니다...
CVE-2026-104963 Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/slug/cycles/ through WorkspaceCyclesEndpoint and GET /api/workspaces/slug/modules/ through WorkspaceModulesEndpoint return records from every project in a workspace without checking whether the requester belongs ...
CVE-2020-0022
이 저장소에는 README가 없습니다...
CVE-2026-104961
The open-source project management tool Plane is vulnerable to an incorrect authorization issue (CWE-863) prior to version 1.4.0 . The WorkspaceOwnerPermission check fails to verify if a user's is_active status is set to True. Consequently, a deactivated user can retain owner-level access to a wo...
CVE-2026-104961 Plane: WorkspaceOwnerPermission missing is_active check allows deactivated users to retain owner access
Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceOwnerPermission does not require isactive=True when checking whether a user is a workspace owner. A deactivated user can therefore remain authorized as the workspace owner and retain owner-level access. This issue is fixed ...
CVE-2026-104961 Plane: WorkspaceOwnerPermission missing is_active check allows deactivated users to retain owner access
Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceOwnerPermission does not require isactive=True when checking whether a user is a workspace owner. A deactivated user can therefore remain authorized as the workspace owner and retain owner-level access. This issue is fixed ...
CVE-2020-3580
이 저장소에는 README가 없습니다...
PoC-for-CVE-2021-38540-
CVE-2021-38540 개념 증명 중요 구성 요소의 인증 누락 취약점 CVE-2021-38540 이 버그에 대하여: Airflow =2.0.0, =2.0.0, variables 변수 목록 아래에 kafkacaptainhookuser라는 변수를 생성하는 요청을 포함합니다. PoC 소스: POST /variable/varimport HTTP/2 Host: airflow.example.com User-Agent: Mozilla/5.0 X11; Linux x8664; rv:91.0 Gecko/20100101 Firefox/91.0...
CVE-2026-48558
CVE-2026-48558: SimpleHelp OIDC 인증 우회 !WARNING 이 코드는 교육 및 연구 목적으로만 "있는 그대로" 제공됩니다. 프로덕션 시스템, 공유 환경 또는 승인되지 않은 대상에서 이 PoC를 사용하지 마십시오. 이 익스플로잇은 Chrome 렌더러 샌드박스를 완전히 손상시킬 수 있는 심각한 원격 코드 실행RCE 취약점CVE-2026-6307을 시연합니다. 이 코드를 실행하거나 호스팅할 경우, 악용 시 안티바이러스 탐지, 보안 모니터링 경고 또는 법적 결과가 발생할 수 있습니다. 저자와 저장소 관리자는 ...
NotCVE-2026-0010
概要 脆弱性: Barrier デーモン TCP ポート 24801 を介した、認証なしの IPC による SYSTEM へのローカル権限昇格 ベンダー: debauchee Barrier プロジェクト 製品: Barrier 2.4.0 最終リリース、2021-11-01 CWE: CWE-306: 重要な機能に対する認証の欠如 説明 Barrier の Windows サービス barrierd.exe は LocalSystem としてインストールおよび実行され、認証、クライアント ID 検証、アクセス制御なしで TCP IPC コントロール サーバーを...