ROOT-APP-NPM-GHSA-R28C-9Q8G-F849 GHSA-r28c-9q8g-f849 in postcss - Patched by Root

Root has patched GHSA-r28c-9q8g-f849 in the postcss package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-54287 CVE-2026-54287 in hono - Patched by Root

Root has patched CVE-2026-54287 in the hono package for Root:npm. Multiple fixed versions available...

MS-SharePoint-July-Patch-RCE-PoC

MS-SharePoint-July-Patch-RCE-PoC PoC 対象: CVE-2024-38094 CVE-2024-38024 CVE-2024-38023 PoC 動画: https://youtu.be/u8mccaakISw...

Vulnerability-Disclosure-Policy

脆弱性開示ポリシー 私たちは、脆弱性の開示は相互理解が重要であると考えています。研究者だけでなく、ベンダーも協調的な脆弱性開示に参加しなければなりません。Enable Securityは独自の調査を通じて脆弱性を発見した場合、その脆弱性をベンダーに通知し、詳細は最初の連絡から90日後に防御コミュニティに公開します。ただし、ベンダーが修正プログラムをリリースした場合は、それより早く公開します。 Enable Securityは、ベンダーとの機密通信の確立に合理的な努力を払います。 ベンダーのセキュリティチームまたは指定された連絡先との連絡が確立された後、Enable...

Sherlock

사용 중단됨. 대신 Watson을 확인하세요. Sherlock 로컬 권한 상승 취약점에 대한 누락된 소프트웨어 패치를 빠르게 찾는 PowerShell 스크립트입니다. 현재 탐지하는 취약점: MS10-015 : User Mode to Ring KiTrap0D MS10-092 : Task Scheduler MS13-053 : NTUserMessageCall Win32k Kernel Pool Overflow MS13-081 : TrackPopupMenuEx Win32k NULL Page MS14-058 : TrackPopupMenu...

python-patrol

Python Patrol macOS 上で Python のインストールをスキャンし、CVE-2015-20107.py スクリプトを実行してパッチ適用が必要かどうかを報告します これらのスクリプトのいくつかはフルディスクアクセス権限が必要で、ルートとして実行する必要があります。これにより macOS ファイルシステム全体（macOS によって制限されている領域を除く）をスキャンできます。 フルディスクアクセス権限を持つアプリからこれを実行してください。つまり、Apple のシステム設定 セキュリティとプライバシー プライバシーとセキュリティで iTerm.app...

Windows-Exploit-Suggester

설명 이 도구는 대상의 패치 수준을 Microsoft 취약점 데이터베이스와 비교하여 대상에 누락된 패치를 탐지합니다. 또한 누락된 게시판에 대해 공개 익스플로잇 및 Metasploit 모듈이 있는 경우 사용자에게 알립니다. Windows 호스트에서 'systeminfo' 명령의 출력을 필요로 하며, 이를 Microsoft 보안 게시판 데이터베이스와 비교하여 호스트의 패치 수준을 결정합니다. --update 플래그를 사용하여 Microsoft에서 보안 게시판 데이터베이스를 자동으로 다운로드하고 Excel 스프레드시트로 저장하는...

VMWare Workspace ONE UEM - Server-Side Request Forgery

VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain a server-side request forgery vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without...

rConfig 3.9.4 - SQL Injection

rConfig 3.9.4 and previous versions have unauthenticated compliancepolicies.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. id: CVE-2020-10546 info: name:...

Apache Superset - Authentication Bypass

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRETKEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset...

FUEL CMS 1.4.1 - Remote Code Execution

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. id: CVE-2018-16763 info: name: FUEL CMS 1.4.1 - Remote Code Execution author: pikpikcu severity: critical description: FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/...

Qlik Sense Enterprise - HTTP Request Smuggling

An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunnelin...

IBM Aspera Faspex <=4.4.2 PL1 - Remote Code Execution

IBM Aspera Faspex through 4.4.2 Patch Level 1 is susceptible to remote code execution via a YAML deserialization flaw. This can allow an attacker to send a specially crafted obsolete API call and thereby execute arbitrary code, obtain sensitive data, and/or execute other unauthorized operations...

Ivanti Endpoint Manager Mobile (EPMM) - Authentication Bypass

Ivanti Endpoint Manager Mobile EPMM, formerly MobileIron Core, through 11.10 allows remote attackers to obtain PII, add an administrative account, and change the configuration because of an authentication bypass, as exploited in the wild in July 2023. A patch is available. id: CVE-2023-35078 info...

CraftCMS - Remote Code Execution

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity...

Oracle WebLogic Server Administration Console - Remote Code Execution

The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Services versions 0.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0 contain an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. id:...

Fortra GoAnywhere MFT - Remote Code Execution

Fortra GoAnywhere MFT is susceptible to remote code execution via unsafe deserialization of an arbitrary attacker-controlled object. This stems from a pre-authentication command injection vulnerability in the License Response Servlet. id: CVE-2023-0669 info: name: Fortra GoAnywhere MFT - Remote...

Yaws 1.91 - Local File Inclusion

Yaws 1.91 allows unauthenticated local file inclusion via /%5C../ submitted to port 8080. id: CVE-2017-10974 info: name: Yaws 1.91 - Local File Inclusion author: 0xAkoko severity: high description: Yaws 1.91 allows unauthenticated local file inclusion via /%5C../ submitted to port 8080. impact: |...

Spring Cloud Gateway Code Injection

Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote...

Jorani 1.0.0 - Remote Code Execution

Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server. id: CVE-2023-26469 info: name: Jorani 1.0.0 - Remote Code Execution author: pussycat0x severity: critical description: | Jorani 1.0.0, an attacker could leverage path traversal to access files...