396 matches found
threat-hunting-guide
Corelight Threat Hunting Guide（作業用コピー） このリポジトリは、Corelight 脅威ハンティングガイドの作業データとして機能します。ここで管理されている本文は、定期的に編集、レイアウト、グラフィックデザインを経て、PDFファイルとして公開され、Corelight, Inc.（「Corelight」）によって配布されます。これらの作業には明確なスケジュールはありませんが、これまでのところ、新しいリリースは6〜12か月ごとに行われています。 最新版の Corelight 脅威ハンティングガイドをご希望の場合は、こちら から入手できます。...
Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting
Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting XSS via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. id: CVE-2025-2711 info: name: Yonyou UFIDA ERP-NC V5.0 -...
Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting
Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting XSS via the key and redirect parameters in login.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. id: CVE-2025-2709 info: name: Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scriptin...
CVE-2025-56764
CVE-2025-56764 — Trivision NC-227WF 概要 Trivision NC-227WF ファームウェア 5.80 ビルド 20141010 のログイン機構は、ユーザー名の存在有無によって異なるエラーメッセージ（"Unknown user" と "Wrong password"）を返すため、攻撃者が有効なユーザー名を列挙できます。該当する CVE レコードは CVE リスト / NVD に公開されています。 影響 ユーザー名の列挙により、標的型ブルートフォース攻撃やクレデンシャルスタッフィング攻撃が可能になります。...
CVE-2025-9074-POC
CVE-2025-9074-POC CVE-2025-9074 の Proof-of-Concept エクスプロイト ⚠️ 法的免責事項 この PoC は教育目的および許可されたセキュリティテストのためにのみ公開されています。 システムへの無断利用は違法かつ非倫理的です。 この PoC は、自分が所有する環境、または明示的なテスト許可を得ている環境でのみ使用してください。 使用方法 ./cve-2025-9074.sh 192.168.65.7 2375 スクリプトを実行する前に、nc リスナーが動作していることを確認してください。...
CVE-2026-95507
An out-of-bounds read was found in the NC-SI OEM response handler of libslirp. A truncated NC-SI OEM Ethernet frame causes ncsirsphandleroem to read up to 4 bytes beyond the supplied packet length and reflect the value into the response sent to the guest, resulting in guest-observable disclosure ...
MAL-2026-15625 Malicious code in evilpostinstall (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 846e500b06f58769a2cb833be8e726ab1db04b327f4c614da6642eb46ae7dfe5 The package's postinstall lifecycle hook pipes the output of env through nc to a host reconstructed at install time from the package version string v...
CVE-2025-2399
Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Mitsubishi Electric CNC M800V Series M800VW and M800VS, M80V Series M80V and M80VW, M800 Series M800W and M800S, M80 Series M80 and M80W, E80 Series E80, C80 Series C80, and M700V Series M750VW, M720VW, 730VW,...
PT-2026-24177
Name of the Vulnerable Software and Affected Versions Mitsubishi Electric CNC M800V Series versions M800VW and M800VS Mitsubishi Electric CNC M80V Series versions M80V and M80VW Mitsubishi Electric CNC M800 Series versions M800W and M800S Mitsubishi Electric CNC M80 Series versions M80 and M80W...
Mitsubishi Electric多款产品 安全漏洞
Mitsubishi Electric CNC Series is a series of numerical control control systems developed by Mitsubishi Electric, a Japanese company. Several products from Mitsubishi Electric have security vulnerabilities. These vulnerabilities stem from improper validation of specified indices, positions, or...
Credential Exposure
Overview nocodb is a NocoDB Affected versions of this package are vulnerable to Credential Exposure in the password column of the ncviews table in public-datas.service.ts, public-metas.service.ts and calendar-datas.service.ts, where passwords are stored in plaintext. An attacker can obtain...
NocoDB has Plaintext Storage of Shared View Passwords
Summary Shared view passwords were stored in plaintext in the database and compared using direct string equality. Details The password column in ncviews stored unhashed passwords. Verification used !== comparison across public-datas.service.ts, public-metas.service.ts, and...
Cross-site Scripting (XSS)
Overview nocodb is a NocoDB Affected versions of this package are vulnerable to Cross-site Scripting XSS via the v-html due to the lack of sanitization. An attacker with Editor role can execute arbitrary scripts in the context of a user's browser by storing malicious content in rich text cells...
Cross-site Scripting (XSS)
Overview nocodb is a NocoDB Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Comment.insert function that that lacks sanitization for stored HTML. An attacker can execute arbitrary JavaScript code in the context of the user's browser by submitting crafted input...
CVE-2020-12109
Certain TP-Link devices allow Command Injection. This affects NC200 2.1.9 build 200225, NC210 1.0.9 build 200304, NC220 1.3.0 build 200304, NC230 1.3.0 build 200304, NC250 1.3.0 build 200304, NC260 1.5.2 build 200304, and NC450 1.5.3 build 200304...
CVE-2023-4748
A vulnerability, which was classified as critical, has been found in Yongyou UFIDA-NC up to 20230807. This issue affects some unknown processing of the file PrintTemplateFileServlet.java. The manipulation of the argument filePath leads to path traversal. The attack may be initiated remotely. The...
CVE-2019-7721
lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters...
CVE-2025-14933
NSF Unidata NetCDF-C NC Variable Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NSF Unidata NetCDF-C. User interaction is required to exploit this vulnerability in that the target must visit a...
CVE-2025-14933: Integer Overflow or Wraparound
NSF Unidata NetCDF-C NC Variable Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NSF Unidata NetCDF-C. User interaction is required to exploit this vulnerability in that the target must visit a...
