sharingIsCaring

sharingIsCaring TwonkyMedia Server 해킹됨 CVE-2018-7171 배경 정보 이 GitHub 저장소는 CVE-2018-7171에 관한 모든 관련 정보를 보관하고 있습니다. 그 이상도 포함 CVE-2018-7171은 TwonkyMedia Server 버전 7.0.11-8.5최신 버전의 디렉터리/파일 트래버설 취약점입니다. 이 취약점을 악용하면 공격자는 TwonkyMedia Server를 실행 중인 장치의 플랫폼과 무관하게 해당 장치에 있는 모든 파일을 나열할 수 있습니다. 나아가 공격자는 이 취약점을...

CVE-2026-52617

CVE-2026-52617 — @sworddut/mcp-ffmpeg-helper: ffmpegツールオプションを介したOSコマンドインジェクション runFFmpegCommand は、MCPツールのパラメータから構築した文字列を spawn…, shell: true に渡すため、options、format、codec、pixelFormat、extraOptions に含まれるシェルのメタ文字が、サーバーを実行しているホスト上で実行されます。 ⚠ 修正版は存在しません 2026-08-22現在、最新のnpmリリースは 0.2.1 であり、これが影響を受ける...

CSV Injection

Overview exceljs is a package to Read, manipulate and write spreadsheet data and styles to XLSX and JSON. Affected versions of this package are vulnerable to CSV Injection through the CSV.write process in lib/csv/csv.js. An attacker can trigger spreadsheet formula execution by supplying a cell...

CVE-2026-63654

Frappe (full-stack web application framework) versions 16.31.0 and earlier contain a vulnerability in the frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py. The whitelisted endpoint is not restricted to POST , meaning it accepts safe HTTP methods (e.g., GET) for st...

CVE-2026-55586

SumatraPDF 3.6.1 and earlier (Windows) contains a heap out-of-bounds write in the vendored CHMLib LZX decompressor. A crafted CHM file can supply malformed Huffman code lengths to make_decode_table in ext/CHMLib/lzx.c. In the long-code branch, internal nodes are written via next_symbol before val...

EUVD-2026-63480

LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configur...

CVE-2026-64969 Insecure Direct Object Reference in ATutor

ATutor is vulnerable to Insecure Direct Object Reference IDOR attack in profile picture related endpoints. Any authenticated user, including a student, can supply another user's memberid in a POST request to the profile album endpoint and permanently delete that user's profile picture, including...

CVE-2026-68900

creationtimestamp| type| source ---|---|--- 2026-08-19 21:01:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mthmtw75wv2t...

MINI-8XH7-CQ46-FFRJ

Bulletin has no description...

MINI-2X84-H83P-C75C

Bulletin has no description...

MINI-J3JQ-W7RX-5XFR

Bulletin has no description...

MINI-HWC4-M8C9-HHF8

Bulletin has no description...

CVE-2026-73849

In CVE-2026-73849, Emlog (2.6.26 and earlier) allows unauthenticated reinstall via install.php?action=reinstall. The code path bypasses the already-installed guard when act != 'reinstall', letting a remote attacker submit hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email...

Linux Distros Unpatched Vulnerability : CVE-2026-56859

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. CVE-2026-56859 Note that Nessus relies on...

PT-2026-72074

Name of the Vulnerable Software and Affected Versions Emlog versions prior to 2.6.27 Description The install.php endpoint allows the action parameter to be set to reinstall without authentication. This bypasses the installation check because the security guard only executes when the $act variable...

PT-2026-70437

Name of the Vulnerable Software and Affected Versions Windows Remote Desktop Services affected versions not specified Description Missing authentication for a critical function allows an authorized attacker to elevate privileges locally, which can lead to full system compromise. Recommendations A...

PT-2026-70050

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter fails to sufficiently sanitize certain request headers before forwarding traffic to internal components. This allows an unauthenticated attacker to send a specially crafte...

PT-2026-70388

Name of the Vulnerable Software and Affected Versions Windows Kernel affected versions not specified Description An issue exists where the allocation of resources occurs without limits or throttling, which allows an unauthorized attacker to cause a denial-of-service condition over a network...

PT-2026-70411

Name of the Vulnerable Software and Affected Versions Windows TCP/IP affected versions not specified Description A null pointer dereference in Windows TCP/IP allows an unauthorized attacker to cause a denial of service over a network. A null pointer dereference occurs when a program attempts to...

PT-2026-70579

Name of the Vulnerable Software and Affected Versions Windows DNS affected versions not specified Description A numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally, which can lead to full system compromise. Recommendations At the moment, there is no...