5021329 matches found
EUVD-2026-76116
The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, so XXE injection can allow data exfiltration and denial-of-service attacks...
CVE-2009-4118
CVE-2009-4118 Cisco VPN Client - 정수 오버플로 서비스 거부 Integer Overflow Denial of Service Exploit-DB 게시물: https://www.exploit-db.com/exploits/10190/ Cisco 공식 Intelligence AlertID 19445 및 크레딧 http://tools.cisco.com/security/center/viewAlert.x?alertId=19445 작성자 Alex Hernandez 일명 @alt3kx...
PoC-CVE-2018-15473
PoC-CVE-2018-15473 OpenSSH до версии 7.7 подвержен уязвимости перечисления пользователей из-за того, что выход для недействительного пользователя не откладывается до полного разбора пакета, содержащего запрос, что связано с auth2-gss.c, auth2-hostbased.c и auth2-pubkey.c. CVE: CVE-2018-15473...
CVE-2026-89298
A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the view-clients role accesses the client registration endpoint to retrieve client details. Due to a failure to mask sensitive...
CVE-2026-89212
A flaw resulting in XML external entity XXE was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 including older unsupported versions of Akana and has been...
CVE-2026-71416
Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to...
CVE-2026-15710
An information leakage vulnerability exists in the Endpoint DLP component epdlpdrv.sys of Netskope Client for Windows prior to version R141. An internal communication channel used by the user-space hook DLL to pass messages through the kernel driver to the daemon lacked proper token-based message...
SMB-Protocol-Vulnerability_CVE-2017-0144
LAB: SMB 프로토콜 취약점을 이용한 Windows 운영 체제 공격 1. 설명 2. 개요 3. 준비 4. 공격 실행 5. 방어 방법 1. 설명 이번 실습에서는 두 대의 컴퓨터를 사용하여 Windows 운영 체제의 SMB 프로토콜 취약점을 이용한 공격을 시뮬레이션합니다. 한 대는 Kali Linux 운영 체제를 실행하며 공격자해커 역할을 합니다. 그리고 다른 한 대는 피해자victim 역할을 합니다. 피해자 컴퓨터는 SMB 취약점이 있는 Windows 7 64비트 운영 체제를 실행 중입니다. 이를 위해 Kali...
Security Bulletin: Multiple vulnerabilities in OpenSSH affect AIX
Summary There are multiple vulnerabilities in OpenSSH used by AIX CVE-2026-73281,CVE-2026-73282, CVE-2026-73283. OpenSSH is used by AIX for remote login. Vulnerability Details CVEID:CVE-2026-73281 DESCRIPTION: In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intend...
CGA-R872-3X2J-X67P
Bulletin has no description...
CGA-HP4W-MGG7-H555
Bulletin has no description...
CGA-HRMX-Q8G4-GPM7
Bulletin has no description...
CGA-R5RC-52CR-MFM6
Bulletin has no description...
CGA-4PJV-79QW-2V54
Bulletin has no description...
CGA-GWW8-24HR-CQ8V
Bulletin has no description...
CVE-2026-88879
A flaw was found in Traefik, an HTTP reverse proxy and load balancer. Due to a discrepancy in how Traefik and certain backend applications process HTTP header names, a remote attacker can smuggle specially crafted headers. This allows the attacker to bypass identity assertions made by Traefik,...
CVE-2026-85594
A flaw was found in Traefik. The software fails to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation within the Kubernetes Ingress provider. This vulnerability allows a namespace-limited tenant, even if excluded from the...
Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection
Anthropic on Thursday revealed it disrupted a campaign mounted by a Russian state-sponsored threat actor that abused Claude for developing an AI-assisted workflow to get ahead of the detection curve. The operation has been attributed to a cyber espionage group it calls GTG-20006 where "GTG" stand...
CVE-2022-22947
CVE-2022-22947 스프링 클라우드 게이트웨이에 대한 코드 인젝션 공격 CVE 요약 스프링 클라우드 게이트웨이 버전 3.1.1+ 및 3.0.7+ 이전 버전에서는 Gateway Actuator 엔드포인트가 활성화되고 노출되며 보안되지 않은 경우 애플리케이션이 코드 인젝션 공격에 취약합니다. 원격 공격자는 악의적으로 조작된 요청을 만들어 원격 호스트에서 임의의 원격 실행을 가능하게 할 수 있습니다. 영향을 받는 버전 Oracle Commerce Guided Search 11.3.2 Oracle Communications...
