171184 matches found
XWiki < 4.10.20 - Remote code execution
XWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, XWiki's database search allows remote code execution through the search text. This allows remote code execution for any visitor of a public wiki or user of a close...
Django Debug Page - Cross-Site Scripting
Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5 has HTML autoescaping disabled in a portion of the template for the technical 500 debug page. We detected that right circumstances DEBUG=True are present to allow a cross-site scripting attack. id: CVE-2017-12794 info: name: Django Debug Page -...
Qlik Sense Enterprise - HTTP Request Smuggling
An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunnelin...
Autonomy Ultraseek - Open Redirect
Open redirect vulnerability in cs.html in the Autonomy formerly Verity Ultraseek search engine allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter. id: CVE-2009-0347 info: name: Autonomy Ultraseek - Open Redirect author: ctflearner...
MinIO Browser API - Server-Side Request Forgery
MinIO Browser API before version RELEASE.2021-01-30T00-20-58Z contains a server-side request forgery vulnerability. id: CVE-2021-21287 info: name: MinIO Browser API - Server-Side Request Forgery author: pikpikcu severity: high description: MinIO Browser API before version...
Cisco ISE < 3.4P2 - Unauthenticated Arbitrary File Upload
Cisco ISE and Cisco ISE-PIC contain an unrestricted file upload vulnerability caused by lack of file validation in an internal API, letting unauthenticated remote attackers upload and execute files as root, exploit requires crafted file upload. id: CVE-2025-20282 info: name: Cisco ISE 3.4P2 -...
flatpak-builder: Host code execution via `git am` hook execution in patch source extraction (`use-git-am`)
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...
Important: Red Hat Security Advisory: flatpak-builder security update
An update for flatpak-builder is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...
cve-2022-24785-poc-lab
Overview This is a simple Node Express app used to explore Moment.js' path traversal vuln CVE-2022-24785. Setup git clone https://github.com/pS3ud0RAnD0m/momentjs.git cd momentjs cat package.json Change 'moment' to '2.29.4' if wanting to test bypasses of the current patch. npm install node app.js...
CVE-2026-31431
CVE-2026-31431 — Copy Fail tracking site Source for the Copy Fail patch-status tracker: a single-page site recording which distributions have shipped a fix for the algifaead privilege escalation in the Linux kernel. Where the facts live Everything about the bug — CVE IDs, affected and fixed...
RHEL 9 : flatpak-builder (RHSA-2026:80496)
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:80496 advisory. Flatpak-builder is a tool for building flatpaks from sources. Security Fixes: flatpak-builder: Host code execution via git am hook execution in patc...
RHEL 10 : flatpak-builder (RHSA-2026:80495)
The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:80495 advisory. Flatpak-builder is a tool for building flatpaks from sources. Security Fixes: flatpak-builder: Host code execution via git am hook execution in pat...
CVE-2020-8554
Create Kubernetes cluster kind create cluster --config ./kind.yaml The cluster must have certmanager: https://cert-manager.io/docs/installation/kubernetes/ Test vulnerability kubectl apply -f - 'EOF' apiVersion: v1 kind: Namespace metadata: name: kubeproxy-mitm --- apiVersion: apps/v1 kind:...
bash-cve-2014-6271-fixes
CVE-2014-6271 patches for bash The original mailing list post only lets you fetch the patches over unauthenticated HTTP. Sigh I've downloaded these over HTTP and put them into a git repository that you can fetch over HTTPS and check independently. I have not checked whether these files are...
CVE-2024-4577
PHP-CGI Windows Platform Remote Code Execution Vulnerability CVE-2024-4577 Introduction PHP is an acronym for Hypertext Preprocessor. It is now a widely used open-source scripting language that is particularly suitable for web development and embedding in HTML, and is very simple to use. CGI, whi...
Mirth-Connect-CVE-2023-43208
CVE-2023-43208: Unauthenticated Remote Code Execution RCE in NextGen Mirth Connect This exploit leverages a critical deserialization vulnerability within Mirth Connect's XStream engine. It stems from an incomplete patch for CVE-2023-37679, enabling unauthenticated arbitrary code execution across...
Rogue-Framework
Rogue Framework "Make it rain. " Rogue Amendiares The best intel-broker in night city Rogue Framework is a desktop workbench for AFL++, cross-architecture QEMU fuzzing, harness development, lightweight Ghidra headless analysis, custom mutators, and patch comparison. It is intentionally an auditab...
grandstream-cve-2026-2329-analysis
Patch and Variant Analysis of CVE-2026-2329 in Grandstream GXP1600 Firmware Defensive static-analysis project comparing Grandstream GXP1600 firmware 1.0.7.79 vulnerable and 1.0.7.81 patched to understand how the vendor remediated the request-parsing flaw associated with CVE-2026-2329. Why this...
CVE-2024-36886
N-Day Vulnerability Research Overview This project focuses on N-Day vulnerabilities in the Linux kernel, with an emphasis on understanding their lifecycle, analyzing their impact, and exploring mitigation strategies. N-Day vulnerabilities are publicly disclosed flaws that remain unpatched on many...