tryhackme-monikerlink-writeup

TryHackMe: Moniker Link — CVE-2024-21413 워크스루 TryHackMe의 "Moniker Link" 룸 전체 워크스루: 2024년 Microsoft Outlook 취약점인 CVE-2024-21413을 무기화하여, 피해자가 피싱 이메일의 링크를 클릭하는 순간 NTLMv2 해시를 탈취하는 방법입니다. 매크로도, 첨부 파일도, 눈에 띄는 보안 경고도 없이 말이죠. CVE-2024-21413"Moniker Link"은 Outlook이 Windows OLE "moniker" 구문경로 뒤의 !, 예:...

Astra Linux – Vulnerability found in Python 3.11, Python 2.7, Python 3.7, and Pypy

The email module in Python, as of version 3.11.3, incorrectly parses email addresses that contain special characters. The incorrect portion of the RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism by allowing access to...

Astra Linux – Vulnerability in python-webob

WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user will be redirected to using Python’s urlparse function, and joining that parsed URL to the base URL. However, the...

Astra Linux – Vulnerability in gst-plugins-good1.0

In GStreamer through 1.26.1, the isomp4 plugin’s qtdemuxparsetrak function may read past the end of a heap buffer while parsing an MP4 file, potentially leading to information disclosure...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: Fixed a bug in extent parsing when ehentries == 0 and ehdepth 0. When traversing inode extents, the ext4extbinsearchidx function assumes that the extent header has been validated previously. However, there are no checks to...

K000163173: Linux kernel MRP vulnerability CVE-2026-53245

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: net/802/mrp: fix vector attribute parsing in mrppduparsevecattr In mrppduparsevecattr, vector attribute events are encoded three per byte and valen tracks the number of events left to process. The...

CVE-2026-68402 wifi: cfg80211: bound element ID read when checking non-inheritance

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: bound element ID read when checking non-inheritance cfg80211iselementinherited reads the first data octet of the candidate element id = elem-data0 to look it up in an extension non-inheritance list. It does so aft...

CVE-2026-71391 Off-by-One Error in GNU Emacs for Android

GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfntvarysimpleglyph and sfntvarycompoundglyph uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font ...

EulerOS 2.0 SP11 : python-ecdsa (EulerOS-SA-2026-3143)

According to the versions of the python-ecdsa packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The ecdsa PyPI package is a pure Python implementation of ECC Elliptic Curve Cryptography with support for ECDSA Elliptic Curve Digital...

EulerOS 2.0 SP11 : python-ecdsa (EulerOS-SA-2026-3089)

According to the versions of the python-ecdsa packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The ecdsa PyPI package is a pure Python implementation of ECC Elliptic Curve Cryptography with support for ECDSA Elliptic Curve Digital...

curl: URL API: triple-slash parses path segment as hostname

Summary libcurl's URL API misparses http:///host/path. Per RFC 3986, the authority between // and / is empty, so /host/path is the path. But parseurl in lib/urlapi.c treats the first segment as the hostname. On line 1087, the slash counter i reaches 3, which is within the valid 1-3 range, and hos...

ALPINE-CVE-2026-32327

A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the aprxmlquoteelem function. Users are recommended to upgrade to version 1.6.4, which fixes this issue...

Important: gstreamer1-plugins-bad-free

Issue Overview: A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units, a 1-byte heap out-of-bounds read can occur during parsing. This happens when the parser attempts to check slice...

CVE-2026-54909

pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3...

SUSE CVE-2026-60074

Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. The parse regexes capture year, month and day with the \d shorthand, which on a character string matches the whole Unicode decimal digit property \pNd and not...

CVE-2026-54722

DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, isurlsafe in src/helpers.ts strips the @ userinfo delimiter with removeatsymbolinstring before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP...

CVE-2026-60074

Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. The parse regexes capture year, month and day with the \d shorthand, which on a character string matches the whole Unicode decimal digit property \pNd and not...

PT-2026-66646

Summary is url safe in v1.0.3 contains an SSRF bypass. remove at symbol in string is applied to the raw URL string before new URL parses it. This strips the @ that separates userinfo from host, corrupting the hostname so internal IPs are never checked. Vulnerability In helpers.ts, is url safe doe...

CVE-2026-58156

Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which f...

CVE-2026-58154

Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which f...