CVE-2025-55182-Exploit

CVE-2025-55182 — Next.js Flight 역직렬화 RCE Next.js Server Actions Flight 역직렬화 취약점에 대한 원격 코드 실행RCE 익스플로잇 📌 개요 이 저장소에는 Next.js Flight 프로토콜Server Actions의 역직렬화 취약점인 CVE-2025-55182 에 대한 동작하는 익스플로잇이 포함되어 있습니다. 악의적인 Flight 청크를 조작하여 인증되지 않은 공격자가 proto 체인then / constructor 가젯을 오염시키고 childprocess 모듈에 도달하여 대...

CVE-2019-7609

CVE-2019-7609 kibana-7609용 docker lab 구성 참조 : https://github.com/mpgn/CVE-2019-7609 Open Kibana Past one of the following payload into the Timelion visualizer Click run On the left panel click on Canvas Your reverse shell should pop ! : payload by @securityMB...

CVE-2018-5951

CVE-2018-5951: MikroTik RouterOS 서비스 거부 취약점 취약점 요약 MikroTik RouterOS의 취약점으로 인해 인증되지 않은 원격 공격자가 라우터를 재부팅하도록 강제할 수 있습니다. 이는 IP 프로토콜 97을 사용하여 1바이트 크기의 패킷을 RouterOS의 IPv6 주소로 전송하여 수행됩니다. EoIPv6를 지원하는 모든 RouterOS 버전이 이 공격에 취약할 가능성이 있습니다. 이 공격은 대상 시스템에서 IPv6가 활성화되어 있고 최소 하나의 터널 인터페이스가 존재해야 합니다. 공격 벡터 대...

[SECURITY] Fedora 45 Update: xcb-proto-1.17.0-12.fc45

XCB is a project to enable efficient language bindings to the X11 protocol. This package contains the protocol descriptions themselves. Language bindings use these protocol descriptions to generate code for marshalling the protocol...

Rocky Linux 8 [CIQ] Security Update: protobuf / protobuf-compiler / protobuf-compiler-debuginfo / etc (crlsa-2022_7464)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20227464 advisory. protobuf: Incorrect parsing of nullchar in the proto symbol leads to Nullptr dereference CVE-2021-22570 Tenable has extracted the preceding description block direct...

CVE-2026-81549

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of the X-Forwarded-Proto header...

CVE-2026-81549

IBM DataStage on Cloud Pak for Data version 5.4.0.0 is vulnerable to a Server-Side Request Forgery (SSRF) (CWE-918) due to improper validation of the X-Forwarded-Proto header. This flaw could allow a remote authenticated attacker to obtain sensitive information. To remediate this vulnerability, I...

CVE-2026-81549 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of the X-Forwarded-Proto header...

EUVD-2026-85911

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of the X-Forwarded-Proto header...

CVE-2026-81549 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of the X-Forwarded-Proto header...

PT-2026-97843

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can obtain sensitive information because the system does not properly validate the X-Forwarded-Proto header. The X-Forwarded-Proto header is used t...

CVE-2026-81549: Server-Side Request Forgery (SSRF)

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of the X-Forwarded-Proto header...

CVE-2026-88339

A NULL pointer dereference vulnerability exists in the gfsgvrmlfieldclone function of GPAC 2d7da22e 26.08-DEV. The vulnerability occurs when cloning a PROTO default SFImage field with a NULL source pointer. An attacker can provide a specially crafted input file that triggers the condition,...

SUSE CVE-2026-27779

Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation...

PT-2026-96056

Name of the Vulnerable Software and Affected Versions Open VSX affected versions not specified Description An unauthenticated remote attacker can poison the per-extension metadata cache by supplying crafted X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Prefix request headers. The...

Linux Distros Unpatched Vulnerability : CVE-2026-92474

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security flaw has been discovered in GPAC 26.08-DEV. This affects the function gfinlinegetprotolib of the file src/compositor/mpeg4inline.c of the component...

PT-2026-94707

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF trampoline mechanism where return values exceeding 8 bytes are not fully preserved. Specifically, the btf distill func proto function allows 16-byte int128...

PT-2026-94706

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem on x86 architectures where the trampoline stack size is incorrectly calculated for 128-bit arguments. The btf distill func proto function accepts...

CVE-2026-92474

A security flaw has been discovered in GPAC 26.08-DEV. This affects the function gfinlinegetprotolib of the file src/compositor/mpeg4inline.c of the component Proto Link Handler. The manipulation results in use after free. The attack requires a local approach. The exploit has been released to the...

CVE-2026-92474

A security flaw has been discovered in GPAC 26.08-DEV. This affects the function gfinlinegetprotolib of the file src/compositor/mpeg4inline.c of the component Proto Link Handler. The manipulation results in use after free. The attack requires a local approach. The exploit has been released to the...