34452 matches found
CVEREV3
CVEREV3 CVE-2021-30858 Rev3 をテスト中 元の投稿 : https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2021/CVE-2021-30858.html...
opa
Open Policy Agent Open Policy Agent OPA は、スタック全体で統一された、コンテキストを考慮したポリシー適用を可能にする、オープンソースの汎用ポリシーエンジンです。 OPA は、Cloud Native Computing Foundation CNCF ランドスケープにおいて graduated プロジェクトであることを誇りに思っています。詳細については、CNCF の発表をお読みください。 OPA を使い始める Rego Playground で最初の Rego...
opa
Open Policy Agent Open Policy Agent OPA is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack. OPA is proud to be a graduated project in the Cloud Native Computing Foundation CNCF landscape. For details read the CNCF...
cryptomator
Cryptomator をサポートする Cryptomator は、開発に多大な労力を要するにもかかわらず、オープンソースプロジェクトとして無償で提供されているため、寄付に依存しています。もし今後の開発にもご興味があれば、以下の方法でサポートしていただけます： Cryptomator のウェブサイトからの一回限りまたは継続的な寄付。 Cryptomator のスポンサーサイトからスポンサーになる。 ゴールドスポンサー --- シルバースポンサー | | ---|---|--- スペシャルシャウトアウト ARM64 ビルド向けの継続的インテグレーションのホスティングは MacStadium...
Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal
Summary Deleting a task relation only requires write access on the base task. Unlike relation creation, it does not verify that the caller can read the other task. A user with write access to one project can therefore delete relations whose other end lives in a project they have no access to. Sin...
Vikunja: Unbounded nested task-filter recursion permits API process termination
Unbounded nested task-filter recursion permits API process termination Summary Authenticated task-list routes accept a filter expression without a length or nesting-depth bound, preprocess it, parse it recursively through fexpr, and recursively convert the resulting expression tree. A syntactical...
Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project
Summary When you share a project with a team, the API lets you attach any team on the instance, including teams you have nothing to do with, as long as you're an admin of the project. Listing a project's teams then returns each team's full member roster. So any logged-in user can spin up a...
EUVD-2026-78651
Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project...
GHSA-39P5-2WRR-XH29 Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project
Summary When you share a project with a team, the API lets you attach any team on the instance, including teams you have nothing to do with, as long as you're an admin of the project. Listing a project's teams then returns each team's full member roster. So any logged-in user can spin up a...
GHSA-4VH2-39RQ-RQ8J Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification
Summary The 50-megapixel decode guard exists only on the task-attachment preview path. Avatar and project-background uploads decode uploaded images with no pixel cap. Worse, the avatar resize fixes the output height at 1024 and derives the width from the aspect ratio, so a tiny extreme-aspect-rat...
Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification
Summary The 50-megapixel decode guard exists only on the task-attachment preview path. Avatar and project-background uploads decode uploaded images with no pixel cap. Worse, the avatar resize fixes the output height at 1024 and derives the width from the aspect ratio, so a tiny extreme-aspect-rat...
Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level
Summary A user who has only read permission on a project can call the single link-share read endpoint and receive the share's hash field — the secret credential that the anonymous POST /shares/share/auth endpoint exchanges for a link-share JWT carrying the share's permission read / read-write /...
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
Summary The task-collection endpoint GET /api/v1/projects/project/views/view/tasks loads the requested project view straight from the URL path without verifying the caller is authorized for it. For a link-share token, the task query is correctly pinned to the share's own project, but the view is...
linux_screenshot_xwindows
Intro The goal of this volatility plugin is to extract a screenshot of all open X windows from a memory dump. Previous work The volatility plugin linuxxwindows realised by Adam Bridge https://github.com/bridgeythegeek/linuxxwindows extracts various metadata from the window objects registered to X...
next-cve-2025-66478
NextJS CVE-2025-66478 現在の作業ディレクトリにある CVE-2025-66478 に対して脆弱なすべてのプロジェクトをスキャンし、それらを報告します。 CVE-2025-66478 の詳細はこちら 警告 このスクリプトは脆弱性を修正しません。脆弱性の特定のみを目的としています。脆弱性とその解決策の詳細については、この記事 を参照してください。 使用方法 プロジェクトがあるメインディレクトリに移動し、./run.sh を実行してください。事前に chmod +x ./run.sh を実行する必要がある場合があります。...
Stardust
Stardust 최신식이고 사용하기 쉬운 32/64비트 쉘코드 템플릿입니다. 원시 문자열 C++20 프로젝트 함수 및 모듈 해결을 위해 fnv1a를 사용한 컴파일 타임 해싱 사용 기본 사용법 PEB에서 resolve::module을 사용하여 모듈 해결: if ! ntdll.handle = resolve::module expr::hashstring L"ntdll.dll" return; if ! kernel32.handle = resolve::module expr::hashstring L"kernel32.dll" return;...
MASTG-Hacking-Playground
MASTG 해킹 플레이그라운드 OWASP 모바일 애플리케이션 보안MAS 프로젝트의 일부인 MASTG 해킹 플레이그라운드에 오신 것을 환영합니다. MASTG 해킹 플레이그라운드는 의도적으로 취약하게 만든 교육용 iOS 및 Android 모바일 앱 모음으로, 개발자, 보안 연구원 및 침투 테스터에게 실질적인 지침을 제공하기 위해 설계되었습니다. 이 앱에 사용된 취약점은 OWASP 모바일 애플리케이션 보안 테스트 가이드MASTG에서 가져왔습니다 모든 테스트 케이스를 완전히 다루지는 않지만, 현재 커버리지를 확장하도록 초대합니다...
redpill
:octocat: Project Description The redpill project aims to assist reverse tcp shells in post-exploration tasks. Often, on redteam appointments we need to use unconventional ways to access the target system, like reverse tcp shells not metasploit in order to bypass the defenses implemented by the...