981377 matches found
syswarden
SysWarden 主机本地 Linux 防御，具备可审计、故障时默认关闭的强制执行机制。 SysWarden 是一款开源 Linux 安全编排器，集成了权威的 nftables 策略、主机遥测、威胁情报列表、带外 WAAP 日志分析、经身份验证的高可用性以及原生终端仪表板。它专为那些希望拥有一个可审查的主机防御层、而又不想在应用数据路径中再放置一个代理的操作人员而设计。 SysWarden 不是内联 HTTP 代理、流量净化器或监管认证产品。 当前源码版本：v4.04.3 。 最新经认证的稳定公开发布版本为 v4.04.3。 功能特性 权威的 nftables...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: usb: ohci-nxp: Fixed the refcount leak in ohcihcdnxpprobe. ofparsephandle returns a node pointer with a refcount incremented; we should use ofnodeput on it when it is no longer needed. Add ofnodeput to avoid the refcount leak...
Astra Linux – Vulnerability in OpenLDAP
In OpenLDAP versions 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function due to a malicious packet. This leads to a denial of service daemon exits caused by a short timestamp. This issue is related to the schemainit.c file and the...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: smb/server: fixed a potential null-ptr-deref of leasectxinfo in smb2open A null-ptr-deref will occur when reqoplevel == SMB2OPLOCKLEVELLEASE and parseleasestate returns NULL. This issue was fixed by checking whether...
CVE-2026-56782-Gorse-Auth-Bypass
CVE-2026-56782 — Gorse 未认证数据库转储/恢复（认证绕过） Gorse 0.5.10 默认配置 adminapikey = ""。主 HTTP 端点 /api/dump 和 /api/restore 通过管理员检查进行控制，但在未配置密钥时 故障开放 ——即默认情况。未认证且可达网络的攻击者可以 窃取整个数据集 （用户、物品、反馈/个人身份信息）或 覆盖它 。...
probo
Probo Open-source GRC platform for engineers. Probo is a self-hostable governance, risk, and compliance GRC platform built for engineering and security teams. It covers the full GRC lifecycle: risk identification, control tracking, vendor risk, data privacy, access reviews, audit programs, and...
CVE-2024-57609
Vulnerabilidad de Redirección Abierta en Kanaries Página del Proveedor: https://kanaries.net/ Video de Prueba de Concepto: https://drive.google.com/file/d/1kqfbmx1W6UgSs56gOLOsUFiGcvKrIyW9/view?usp=sharing Guía de Explotación Paso a Paso 1. Ir al Sitio Web Navegue al sitio web de Kanaries. 2...
OpenSC.tokend
OpenSC.tokend El controlador de tarjetas inteligentes de código abierto para OS X Un tokend hace que las claves y certificados de tu tarjeta inteligente aparezcan en Keychain Access.app y estén disponibles para aplicaciones como Safari o Chrome. OpenSC.tokend es la implementación de tokend de...
CVE-2025-64495-POC
CVE-2025-64495-POC Open WebUI 在启用“以富文本方式插入提示”时，存在通过提示触发的存储型 DOM XSS 漏洞，可导致账户接管（ATO）或远程代码执行（RCE） 摘要 当“以富文本方式插入提示”功能启用时，将自定义提示插入聊天窗口的功能容易受到 DOM XSS 攻击，因为提示内容被直接赋值给 DOM sink .innerHtml 而未经过净化。任何拥有创建提示权限的用户都可以利用此漏洞植入载荷，其他用户如果执行对应的 / 命令来插入该提示，就会触发该载荷。 详情 受影响的代码行位于：...
Real Estate
Open Arsenal 房地产规范 房地产生态系统围绕这样一个理念构建：将房产情报从中心化挂牌平台转移至本地托管、自我主权的数据环境 。该设计不依赖第三方平台来定义、存储或解读挂牌信息，而是将每一条房产记录视为可移植的结构化数据集，能够独立存在于服务器、设备或私有基础设施之上。这些记录在格式上保持严格一致，以便空间细节、估值输入和描述性属性能够被应用程序和 AI 系统统一处理。由此产生的模型让房地产信息不再像网站上的静态内容，而更像一个可组合的数据层，可以在多个系统中复用、验证和扩展，且不损失完整性。 与这一结构性转变并行的，是对密码学安全与区块链启发的验证机制...
CVE-2026-47883
CVE-2026-47883: Spring Framework UrlHandlerFilter Open Redirect PoC 이 저장소는 Spring 공식 보안 권고문으로 공개된 CVE-2026-47883의 최소 재현 PoC입니다. 공식 권고문: https://spring.io/security/cve-2026-47883/ 공식 제목: Spring Framework Open Redirect in UrlHandlerFilter 심각도: Medium CVSS v3.1: 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A...
CVE-2023-24034
An issue was discovered in twilioajaxhandler.php in Nagios XI before 5.9.3. An attacker can force a user to visit a malicious site by using a open redirect vulnerability...
invesalius3_vulnerabilities
invesalius3vulnerabilities 简介 https://github.com/invesalius/invesalius3 是参考实现，一个开源项目。 结构 每个漏洞将采用以下结构： root@kitploit: folder/ |README.md |subfolder/ |artifacts 命名为 CVE-ID（如果分配了ID），如果没有分配ID则命名为 VULN-NAME 或 TMP-N。 每个 folder/ 将在 README.md 文件中注明贡献者。 当前 可用的POC： CVE-2024-44825 CVE-2024-42845 partwave...
cve-2026-46391
CVE-2026-46391 - 通过 SSRF 暴露 @haxtheweb/open-apis 中的凭证 CVE-2026-46391 的概念验证。触发 @haxtheweb/open-apis 中 cacheAddress 端点的 SSRF 漏洞，并捕获回调中发送的服务账户凭证。 构建 root@kitploit: go build -o cve-2026-46391 . 测试 root@kitploit: go test ./... 用法 root@kitploit: ./cve-2026-46391 -u -l -p 端口 -t 秒 -v 选项 示例 直接连接（与目标在同一网络）...
EUVD-2026-77131
A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. The attack may be initiated remotely. The...
EUVD-2026-77138
A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be...
PT-2026-91187
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Apache Syncope. When the Syncope SRA is configured for CAS authentication, the target Apereo CAS instance's URL is calculated by unconditionally looking at client-supplied forwarded HTTP headers. This issue affects Apache Syncope:...
CVE-2023-24034
Nagios XI before 5.9.3 contains an open redirect vulnerability in twilio_ajax_handler.php , allowing an unauthenticated attacker to force a user to visit a malicious site. The CVSS v3.1 base score is 3.1 (Low) , reflecting the need for user interaction and high attack complexity. The fix is avail...
