cve-2021-42013

Apache 2.4.50 - 경로 탐색 또는 원격 코드 실행 CVE-2021-42013.py는 Apache 2.4.50에서 경로 탐색 또는 원격 코드 실행 취약점을 찾는 데 도움이 되는 파이썬 스크립트입니다. CVE-2021-42013을 실습하기 위해 취약한 Docker 인스턴스가 제공됩니다. CGI-BIN이 활성화된 경우, 경로 탐색은 불가능하지만 원격 코드 실행이 가능하므로, 경로 탐색 취약점을 확인하기 위해 httpd.conf의 Alias 섹션에 "icons" 디렉토리를 추가했습니다. httpd.conf의 취약한 구성 1...

CVE-2026-105795

Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe...

Vulnerability-CVE-2025-64446-CVE-2025-58034

FortiWeb 착취 시뮬레이션 CVE-2025-64446 & CVE-2025-58034 참고 사항: 이 문서는 학습 및 보안 연구 목적으로만 제공됩니다. 허가 없이 시스템을 공격하는 데 사용하지 마십시오. 1. 개요 FortiWeb은 웹 애플리케이션을 보호하는 WAFWeb Application Firewall 장치입니다. 2025년에 두 가지 심각한 취약점이 발견되었습니다: CVE-2025-64446 – 경로 탐색Path Traversal을 통한 인증 우회 CVE-2025-58034 – OS 명령 주입 2...

cve-2023-34035-mitigations

Этот репозиторий содержит набор примеров, демонстрирующих конфигурации, в которых приложения могут быть уязвимы к https://spring.io/security/cve-2023-34035CVE-2023-34035. Приложение уязвимо, если выполняются все следующие условия: Spring MVC находится в classpath DispatcherServlet и как минимум е...

challack

Пример кода Proof-of-concept для CVE-2016-5696 Этот код в настоящее время позволяет сбрасывать соединения или внедряться в сеансы. Атака реализована как против клиентов, так и против серверов. Подробную информацию см. в оригинальной публикации: Off-Path TCP-эксплойты: глобальное ограничение...

linux-kernel-codex-harness

Kernel Codex Harness 한국어 | English Research Tool · Original Import: 3 April 2026 · Documentation Revision: 11 July 2026 Core Philosophy — External Signal Let reproducible observations outside model inference guide attention; never mistake priority for proof. Project status. 이 저장소는 실제 Linux 커널 취약점...

CVE-2021-41773S

Уязвимые Docker-образы для CVE-2021-41773 Apache path traversal Эта уязвимость применима только к версии 2.4.49 с определёнными нестандартными конфигурациями. В определённых ситуациях это может привести либо к чтению файлов, либо к выполнению кода...

EUVD-2026-93424

Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe...

CVE-2026-105795 Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests

Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe...

CVE-2026-105840

lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath in src/lrz.c only rejects '../' sequences unless built with...

CVE-2026-43637-cornac

CVE-2026-43637: Cornac の extractarchive におけるパストラバーサル（Tar Slip） 深刻度: 高（High）、CVSS 4.0 8.8 、致命的（Critical）、CVSS 3.1 9.1 （CNA である VulnCheck による割り当て） ベクター（v4.0）: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N ベクター（v4.0）: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H 影響を受けるバージョン: cornac...

EUVD-2026-93392

lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath in src/lrz.c only rejects '../' sequences unless built with...

CVE-2026-105840 lrzsz before 0.13.0 Path Traversal via lrz Restricted Mode checkpath()

lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath in src/lrz.c only rejects '../' sequences unless built with...

CVE-2026-105840

lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath in src/lrz.c only rejects '../' sequences unless built with...

CVE-2026-105840

The lrzsz utility, in versions before 0.13.0 , is vulnerable to a path traversal issue within the lrz receive utility's restricted mode. The root cause is located in src/lrz.c, where the checkpath() function fails to reject absolute pathnames unless the software is specifically built with --enabl...

CVE-2026-105834

Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path. Attackers can retrieve file contents through editProjectNodeSourceFile or the...

s2-067-CVE-2024-53677

s2-067-CVE-2024-53677 s2-067CVE-2024-53677 Краткое описание Логика загрузки файлов содержит ошибку, позволяющую атакующему использовать обход путей path traversal, — проблема, аналогичная описанной в S2-066 Кому следует это прочитать Всем разработчикам и пользователям Struts 2 Влияние уязвимости...

Mitigation-Apache-CVE-2021-41773-

Mitigation-CVE-2021-41773- Скрипт оболочки для смягчения CVE-2021-41773, уязвимости обхода пути и раскрытия файлов в Apache Установка wget https://github.com/EkamSinghWalia/Mitigation-CVE-2021-41773-.git Использование Полное исправление и рекомендуемый способ смягчения уязвимости Этот скрипт...

CVE-2026-105834 Rundeck before 6.2.0 Arbitrary File Read via File Resource Model Source

Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path. Attackers can retrieve file contents through editProjectNodeSourceFile or the...

EUVD-2026-93378

Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path. Attackers can retrieve file contents through editProjectNodeSourceFile or the...