rosenbridge

项目：rosenbridge ：x86 CPU中的硬件后门 github.com/xoreaxeaxeax/rosenbridge // domas // @xoreaxeaxeax 概述 项目：rosenbridge 揭示了某些台式机、笔记本电脑和嵌入式 x86 处理器中的硬件后门。 该后门允许 ring 3（用户态）代码绕过处理器保护，自由读写 ring 0（内核态）数据。虽然该后门通常处于禁用状态（需要 ring 0 执行才能启用），但我们发现它在某些系统上 默认启用 。 此仓库包含用于检查您的处理器是否受影响、关闭后门（如果存在）的实用程序，以及用于发现和分析后门的研究和工具。 ...

CVE-2021-36750

CVE-2021-36749 Acerca de - En el sistema de ingesta de Druid, el InputSource se utiliza para leer datos de una determinada fuente de datos. Sin embargo, el HTTP InputSource permite a los usuarios autenticados leer datos de otras fuentes distintas a las previstas, como el sistema de archivos local...

CVE-2026-77124 Nexus Repository 3 - Script Execution Disable Setting Not Enforced

In affected versions of Nexus Repository 3, the script execution endpoint POST /service/rest/v1/script/name/run did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an...

nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw

A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories...

CVE-2025-20029

CVE-2025-20029: Inyección de Comandos en la CLI TMSH de F5 BIG-IP Existe una vulnerabilidad de inyección de comandos en la CLI restringida “tmsh” de F5 que permite a un atacante autenticado aprovechar los comandos accesibles por un usuario de bajo privilegio para eludir restricciones, inyectar...

CVE-2026-82732 Declared argument constraints not enforced on AshTypescript typed controller routes

Improper Input Validation vulnerability in ash-project ashtypescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ashtypescript/typedcontroller/requesthandler.ex calls...

cve-2020-13933

cve-2020-13933 cve-2020-13933 Apache Shiro privilege bypass vulnerability This reproduction is very simple. First, set up the environment using IDEA + Shiro Reference: https://www.cnblogs.com/ph4nt0mer/p/13535999.html Then run, access, and capture packets...

YellowKey-Bitlocker-CVE-2026-45585

🛡️ YellowKey-Bitlocker-CVE-2026-45585 - Recover Your BitLocker Keys Safely 📋 What This Software Does YellowKey is a free open-source utility for Windows 10 and Windows 11. It helps you extract, backup, and view your BitLocker recovery keys. This is useful if you lost access to your encrypted drive...

CVE-2026-55545

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic without ObjectPrivilegeType.ReadPacket,...

Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilities

Summary Multiple Missing Function Level Access Control vulnerabilities exist in the Yamcs Core API. These vulnerabilities allow any authenticated user, regardless of their assigned roles or privileges e.g., an unprivileged "Guest", to bypass intended access controls. An attacker can exploit these...

CVE-2026-78892

Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a local attacker to bypass system access restrictions via a local program. Chromium security severity: Medium...

CVE-2026-55095

OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw customfield project attribute. The dialog path resolves the project custom field by its raw identifier without...

CVE-2026-64965

ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user e.g. a student enrolled in a course can bypass authorization checks by sending requests directly to the backend import endpoints, allowing the unauthorized import of test...

CVE-2026-64965 Missing Authorization Check in ATutor

ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user e.g. a student enrolled in a course can bypass authorization checks by sending requests directly to the backend import endpoints, allowing the unauthorized import of test...

EUVD-2026-63366

ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user e.g. a student enrolled in a course can bypass authorization checks by sending requests directly to the backend import endpoints, allowing the unauthorized import of test...

CVE-2026-76354

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could affect system integrity and availability by sending a crafted Representational State Transfer REST API request that deletes or temporarily overwrites files...

CVE-2026-76313

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code Execution RCE by uploading a malicious knowledge bundle and causing it to be used by distributed search, which can allow for access to all...

CVE-2026-76319

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the fshmanage capability could perform Remote Code Execution through Federated Search bundle selection. This could allow for access to all relevant data and affect system integrity and...

CVE-2026-76313

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, the REST API knowledge bundle upload endpoint lacks the edit_dist_peer capability check, allowing non-admin users to upload malicious bundles used by distributed search, enabling RCE. Splunk's advisory (SVD-2026-0801) provide...

CVE-2026-53546

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a user-controlled hostConfig.id and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access. When...