rosenbridge

project:rosenbridge : x86 CPUs में हार्डवेयर बैकडोर github.com/xoreaxeaxeax/rosenbridge // domas // @xoreaxeaxeax अवलोकन project:rosenbridge कुछ डेस्कटॉप, लैपटॉप और एम्बेडेड x86 प्रोसेसर में एक हार्डवेयर बैकडोर का खुलासा करता है। यह बैकडोर रिंग 3 यूज़रलैंड कोड को प्रोसेसर सुरक्षा को दरकिनार करके...

CVE-2026-77124 Nexus Repository 3 - Script Execution Disable Setting Not Enforced

In affected versions of Nexus Repository 3, the script execution endpoint POST /service/rest/v1/script/name/run did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an...

nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw

A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories...

CVE-2025-20029

CVE-2025-20029 : Injection de commandes dans la CLI TMSH sur F5 BIG-IP Une vulnérabilité d'injection de commandes existe dans la CLI restreinte « tmsh » de F5, qui permet à un attaquant authentifié d'exploiter les commandes accessibles par un utilisateur à faibles privilèges afin de contourner le...

CVE-2026-82732 Declared argument constraints not enforced on AshTypescript typed controller routes

Improper Input Validation vulnerability in ash-project ashtypescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ashtypescript/typedcontroller/requesthandler.ex calls...

cve-2020-13933

cve-2020-13933 cve-2020-13933 ثغرة تجاوز الصلاحيات في Apache Shiro هذا الإعادة بسيطة جداً، أولاً قم بإعداد البيئة باستخدام IDEA + Shiro المرجع: https://www.cnblogs.com/ph4nt0mer/p/13535999.html ثم قم بتشغيله، وقم بزيارته، ثم التقط الحزمة...

YellowKey-Bitlocker-CVE-2026-45585

🛡️ YellowKey-Bitlocker-CVE-2026-45585 - Récupérez vos clés BitLocker en toute sécurité 📋 Ce que fait ce logiciel YellowKey est un utilitaire gratuit et open-source pour Windows 10 et Windows 11. Il vous aide à extraire, sauvegarder et consulter vos clés de récupération BitLocker. Cela est utile si...

CVE-2021-36750

CVE-2021-36749 Informazioni - Nel sistema di ingestion di Druid, InputSource viene utilizzato per leggere dati da una determinata fonte dati. Tuttavia, HTTP InputSource consente agli utenti autenticati di leggere dati da altre fonti rispetto a quelle previste, come il file system locale, con i...

CVE-2026-55545

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic without ObjectPrivilegeType.ReadPacket,...

Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilities

Summary Multiple Missing Function Level Access Control vulnerabilities exist in the Yamcs Core API. These vulnerabilities allow any authenticated user, regardless of their assigned roles or privileges e.g., an unprivileged "Guest", to bypass intended access controls. An attacker can exploit these...

CVE-2026-78892

Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a local attacker to bypass system access restrictions via a local program. Chromium security severity: Medium...

CVE-2026-55095

OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw customfield project attribute. The dialog path resolves the project custom field by its raw identifier without...

CVE-2026-64965

ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user e.g. a student enrolled in a course can bypass authorization checks by sending requests directly to the backend import endpoints, allowing the unauthorized import of test...

CVE-2026-64965 Missing Authorization Check in ATutor

ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user e.g. a student enrolled in a course can bypass authorization checks by sending requests directly to the backend import endpoints, allowing the unauthorized import of test...

EUVD-2026-63366

ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user e.g. a student enrolled in a course can bypass authorization checks by sending requests directly to the backend import endpoints, allowing the unauthorized import of test...

CVE-2026-76354

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could affect system integrity and availability by sending a crafted Representational State Transfer REST API request that deletes or temporarily overwrites files...

CVE-2026-76313

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code Execution RCE by uploading a malicious knowledge bundle and causing it to be used by distributed search, which can allow for access to all...

CVE-2026-76319

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the fshmanage capability could perform Remote Code Execution through Federated Search bundle selection. This could allow for access to all relevant data and affect system integrity and...

CVE-2026-76313

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, the REST API knowledge bundle upload endpoint lacks the edit_dist_peer capability check, allowing non-admin users to upload malicious bundles used by distributed search, enabling RCE. Splunk's advisory (SVD-2026-0801) provide...

CVE-2026-53546

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a user-controlled hostConfig.id and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access. When...