CVE-2023-31445-Unprivileged-Information-Disclosure

CVE-2023-31445 - 権限なし情報漏洩 Unprivileged Information Disclosure このリポジトリには、Dodge Industrial Team が Dodge OPTIFY プラットフォーム向けに発見した CVE-2023-31445 の説明が含まれています。 CVE ID: CVE-2023-31445 ベンダー: Cassia Networks 製品: Access Controller バージョン: Cassia-AC-2.1.1.2203171453 脆弱性: 権限なし情報漏洩 Unprivileged Information...

CVE-2026-77807 AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the username Parameter. This makes it possible for unauthenticated attackers to read the conten...

CVE-2026-77807

CVE-2026-77807 is a Directory Traversal vulnerability in the AcyMailing WordPress plugin (all versions up to and including 11.0.4 ), accessible via the user[name] parameter. An unauthenticated attacker can read arbitrary files on the server, potentially exposing sensitive information. Exploitatio...

Gitea-Forgejo-CVE-2025-68937

Gitea および Forgejo における任意テンプレート展開の脆弱性 この作品は クリエイティブ・コモンズ 表示-継承 4.0 国際ライセンス の下でライセンスされています。 概要 Forgejo と Gitea のソースコードを確認し、テンプレート処理の仕組みをより深く理解していたところ、認証済みユーザーが悪意のあるテンプレートリポジトリを作成し、ファイルシステム上の任意のファイルを処理できる脆弱性を発見しました。 悪意のあるテンプレートの Git コンテンツに基づいてリポジトリを作成すると、テンプレートがファイルシステム上の任意のファイルを展開できるようになります。 git...

CVE-2026-16172

Netskope was notified of an out-of-bounds heap read affecting the Endpoint DLP EPDLP service of the Netskope Client. A local standard user could potentially send a specially crafted message that is not properly validated with a bounds check, likely crashing the kernel driver handler. Successful...

Arbitrary-File-Read-CVE-2024-24919

任意文件读取 CVE-2024-24919 以下是 SIEM 上收到的告警 首先，什么是 CVE-2024-24919？以下是 NIST 网站上的描述。 经过进一步研究，CVE-2024-24919 是一种路径遍历攻击，这解释了为何请求指向 '/etc/passwd' 目录。 /etc/passwd 目录存储了用户账户信息，包括用户名、用户 ID（UID）、组 ID（GID）、主目录和登录 shell。 这足以让我封禁该服务器，我还会进一步调查是否有其他受损迹象。 调查可疑 IP 首先，我在威胁情报源中检查源 IP。该 IP 已被标记为恶意，特别是因为 CVE-2024-24919。 该...

CVE-2024-24919-Incident-Report.md

🛡️ SOC287 - Checkpoint 安全网关上的任意文件读取漏洞 CVE-2024-24919 日期： 2024年6月6日 调查类型： Web 攻击 平台： LetsDefend 触发规则： SOC287 – 检测到任意文件读取 CVE： CVE-2024-24919 严重性： 高 影响： 通过路径遍历未授权访问敏感系统文件 📌 摘要 2024年6月6日，CP-Spark-Gateway-01 上触发了一条告警，表明 CVE-2024-24919 （一个影响 Check Point 安全网关的零日任意文件读取漏洞）被成功利用。...

CVE-2026-3055

🔥 NetScalerBleed2：Citrix NetScaler 中的严重未授权内存过度读取 CVE-2026-3055 未授权越界内存读取（内存泄漏） 仅适用于配置为 SAML 身份提供程序 IdP 的设备 📋 概述 CVE-2026-3055 是 Citrix NetScaler ADC 和 NetScaler Gateway 中的一个严重 越界读取漏洞（CWE-125）。 该漏洞由 SAML 处理过程中输入验证不足 导致。未授权 远程攻击者可触发内存过度读取，泄露设备内存中的敏感数据——包括活动的会话令牌 、凭据或其他机密（在特定条件下）。...

CVE-2026-16172

CVE-2026-16172 affects the Endpoint DLP (EPDLP) service of the Netskope Client , where an out-of-bounds heap read occurs due to a missing bounds check on a specially crafted message. A local standard user can trigger the flaw, causing the kernel driver handler to crash and potentially interruptin...

CVE-2026-16172 Netskope Endpoint DLP Service Out-of-Bounds Read Leading to Process Crash

Netskope was notified of an out-of-bounds heap read affecting the Endpoint DLP EPDLP service of the Netskope Client. A local standard user could potentially send a specially crafted message that is not properly validated with a bounds check, likely crashing the kernel driver handler. Successful...

CVE-2026-79725

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control...

CVE-2026-79725

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control...

DEBIAN-CVE-2026-49836

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an...

CVE-2026-49836

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an...

CVE-2026-54054

Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0, Transmute's URL import endpoint, POST /api/files/url, is vulnerable to Server-Side Request Forgery SSRF. The HTTP downloader used by this endpoint fetches user-supplied URLs with redirects...

CVE-2026-49836

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an...

UBUNTU-CVE-2026-49836

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an...

EUVD-2026-75806

GoBGP is an open source Border Gateway Protocol BGP implementation in the Go Programming Language. Versions prior to 4.6.0 contain a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded b...

CVE-2026-49837 GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries

GoBGP is an open source Border Gateway Protocol BGP implementation in the Go Programming Language. Versions prior to 4.6.0 contain a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded b...

CVE-2026-49837 GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries

GoBGP is an open source Border Gateway Protocol BGP implementation in the Go Programming Language. Versions prior to 4.6.0 contain a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded b...