EUVD-2026-87459

OpenClaw is an agent gateway distributed via npm. In versions = 2026.4.10 and 2026.7.1, persistent memory dreaming mutations omit owner permission checks. An authorized but non-owner external-channel sender can issue the persistent '/dreaming on' and '/dreaming off' commands to enable or disable...

CVE-2023-42442

CVE-2023-42442 CVE-2023-42442 JumpServer Session 録画任意ダウンロード脆弱性 脆弱性説明 CVE-2023-42442は、Jumpserverの2つのバグを含む複合的な脆弱性です。 1. APIの認可されていないアクセスによるセッション情報の漏洩 2. ディレクトリ権限のバイパスによる録画ファイルのダウンロード USAGE Python Version root@kitploit: python CVE-2023-42442.py -h ██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ █████...

CVE-2023-2640-CVE-2023-32629

GameOverlay Ubuntu 権限昇格 CVE-2023-2640 https://www.cvedetails.com/cve/CVE-2023-2640/ c914c0e27eb0 と「UBUNTU: SAUCE: overlayfs: trusted.overlayfs. xattrs の権限チェックをスキップ」の両方を搭載した Ubuntu カーネルでは、特権のないユーザーがマウントされたファイルに特権拡張属性を設定できる可能性があり、適切なセキュリティチェックなしに上位ファイルに設定される可能性があります。 CVE-2023-32629...

gtfobins-cli

🚀 GTFOBins CLI 개요 GTFOBins CLI 는 GTFOBins의 명령줄 인터페이스로, 유닉스 바이너리 익스플로잇 기술에 대한 즉각적인 접근을 제공합니다. 이 도구는 보안 전문가와 시스템 관리자가 합법적인 유닉스 바이너리가 보안 제한을 우회하기 위해 어떻게 오용될 수 있는지 식별하고 이해하는 데 도움을 줍니다. 주요 기능 🔍 빠른 바이너리 검색 : 모든 유닉스 바이너리에 대한 익스플로잇 기술 검색 🔎 퍼지 검색 : 부분 이름 일치로 바이너리 찾기 🏷️ 유형별 필터링 : 익스플로잇 유형shell, suid, sudo...

AOSP-DownloadProviderHijacker

AOSP-DownloadProviderHijacker Androidのダウンロードプロバイダーにおける権限バイパスを悪用するPoC CVE-2018-9468 セキュリティアドバイザリ https://ioactive.com/wp-content/uploads/2019/04/IOActive-Security-Advisory-Androids-Download-Provider-Permission-Bypass-CVE-2018-9468.pdf 詳細情報...

CVE-2026-93363

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint...

CVE-2026-67407

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23, Incomplete fix for CVE-2026-44838: escaperegexchar/1 does not escape -, leaving room for an MQTT topic permission bypass. the CVE-2026-44838 fix made expandtopicpermission/2 escape regex...

CVE-2026-67241

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, AMQP 1.0 management exchange.declare skips alternate-exchange permission check. pUT /exchanges/:name lines 192-240 checks only configure on the declared exchange and passes XArgs straight to rabbitexchange:declare/7. ...

CVE-2026-56724

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An issue with permission checks in the knowledge base management area has been identified. Under certain conditions, data validation for linked items was not fully enforced. This could have allowed users...

EUVD-2026-87203

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An issue with permission checks in the knowledge base management area has been identified. Under certain conditions, data validation for linked items was not fully enforced. This could have allowed users...

CVE-2026-67407

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23, Incomplete fix for CVE-2026-44838: escaperegexchar/1 does not escape -, leaving room for an MQTT topic permission bypass. the CVE-2026-44838 fix made expandtopicpermission/2 escape regex...

CVE-2026-67407 RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23, Incomplete fix for CVE-2026-44838: escaperegexchar/1 does not escape -, leaving room for an MQTT topic permission bypass. the CVE-2026-44838 fix made expandtopicpermission/2 escape regex...

CVE-2026-67407 RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23, Incomplete fix for CVE-2026-44838: escaperegexchar/1 does not escape -, leaving room for an MQTT topic permission bypass. the CVE-2026-44838 fix made expandtopicpermission/2 escape regex...

CVE-2026-67411 RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSocket behind a trusted PROXY Protocol frontend could lose the proxy-derived client address before the MQTT authentication path checked loopbackusers, causing th...

CVE-2026-67411 RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSocket behind a trusted PROXY Protocol frontend could lose the proxy-derived client address before the MQTT authentication path checked loopbackusers, causing th...

CVE-2026-67241 RabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission check

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, AMQP 1.0 management exchange.declare skips alternate-exchange permission check. pUT /exchanges/:name lines 192-240 checks only configure on the declared exchange and passes XArgs straight to rabbitexchange:declare/7. ...

CVE-2026-67241 RabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission check

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, AMQP 1.0 management exchange.declare skips alternate-exchange permission check. pUT /exchanges/:name lines 192-240 checks only configure on the declared exchange and passes XArgs straight to rabbitexchange:declare/7. ...

TeamViewer_Permissions_Hook_V1

TeamViewer Permissions Hook V1 概念実証用のインジェクタブルC++ DLLであり、ネイキッドインラインフッキングと直接メモリ改変を使用してTeamViewerの権限を変更します。 機能 サーバー側 - 右側のポップアップメニューに追加のメニュー項目オプションを有効にします。これまで最も有用なのは、通常はクライアントとの制御認証が完了し、制御/サイドの変更を開始した後にのみアクティブになる「サイド切り替え」機能を有効にすることです。 クライアント側 - サーバーの現在の制御設定や権限に関係なく、マウスの制御を可能にします。 デモ サーバー側 クライアント側...

Nginx-CVE-2013-4547

Nginx のファイル名ロジック脆弱性（CVE-2013-4547） 脆弱性の説明 影響バージョン：Nginx 0.8.41 1.4.3 / 1.5.0 1.5.7 参考リンク： https://vulners.com/cve/CVE-2013-4547 https://blog.werner.wiki/file-resolution-vulnerability-nginx/ http://www.91ri.org/9064.html 脆弱性の説明...

CVE-2022-0492

CVE-2022-0492 コンテナエスケープ分析 toc 脆弱性概要 脆弱性番号: CVE-2022-0492 脆弱性製品: linux kernel - cgroup 影響バージョン: linux kernel 5.17-rc3 脆弱性の影響: コンテナに追加のセキュリティ対策が施されていない場合、コンテナ内のroot権限を取得することでホストにエスケープ可能 環境構築 脆弱性のあるバージョンのカーネルを搭載したLinux上でdockerを使用する。 root@kitploit: すべてのセキュリティ保護を無効にしてdockerを起動 docker run --rm -it -h c...