bitcoin-security

bitcoin-security 비트코인 키 보안이 실제로 어디에서 비롯되는지 — 그리고 어디에서 비롯되지 않는지에 대한 교육용 연구입니다. 실제 BIP39/BIP32 파생을 기반으로, 동일한 아이디어의 양극단에 놓인 두 가지 실험을 담고 있습니다:...

CVE-2026-87984

An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from permission checks, enabling otherwise allowlisted commands to wri...

EUVD-2026-76119

An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from permission checks, enabling otherwise allowlisted commands to wri...

CVE-2026-87984

Mistral Vibe , introduced in version 1.3.4 , contains an arbitrary file write vulnerability. The root cause is that shell redirection destinations are omitted from permission checks , allowing otherwise allowlisted commands to create or overwrite files at arbitrary paths accessible to the Vibe pr...

CVE-2026-87984

An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from permission checks, enabling otherwise allowlisted commands to wri...

CVE-2019-6440

CVE-2019-6440: 테스트된 제품: Zemana antimalware v.2.74.2.150 & Zemana antilogger v.2.74.204.150. v.2.74.2.664부터 수정됨 취약점 정보: 이 취약점으로 인해 공격자는 사용자 상호작용 없이 대상 시스템에서 SYSTEM 권한을 얻을 수 있었습니다. 요구 사항: 1. 공격자는 "POST /api/client/settings/" URL로 전송되는 POST 요청의 내용을 가로채고 변경할 수 있어야 합니다. 2. 대상 PC에 대한 물리적 접근이 필요하지 않습니다...

CVE-2026-87983

An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation enables files outside the active workspace ...

CVE-2026-87983

An arbitrary file read vulnerability in Mistral Vibe (introduced in version 2.6.0 ) allows an attacker to bypass workspace restrictions by using quoted absolute paths in allowlisted shell commands. The root cause is improper handling of quotation marks during path validation, enabling files outsi...

EUVD-2026-76118

An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation enables files outside the active workspace ...

CVE-2026-87983

An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation enables files outside the active workspace ...

CVE-2025-32463

CVE-2025-32463 탐지 프레임워크 sudo chroot 권한 상승 취약점CVE-2025-32463을 대상으로 한 익스플로잇 시도를 식별하도록 설계된 포괄적인 보안 모니터링 및 탐지 프레임워크입니다. 이 프로젝트는 고급 위협 탐지 방법론, 침해 대응 능력 및 방어적 보안 엔지니어링을 보여줍니다. 🔍 개요 CVE-2025-32463은 sudo 1.9.14에서 1.9.17 버전의 중요한 권한 상승 취약점으로, --chroot 옵션을 사용할 때 /etc/nsswitch.conf 조작을 통해 로컬 사용자가 루트 액세스 권한을 ...

Pwdlyser

Pwdlyser New repo for Public release Pwdlyser P assw ord -Analyser is a multi-functional analysis tool created to provide security professionals and organisations aiming to improve their security posture with the ability to easily review and analyse passwords from Active Directory domain accounts...

CVE-2026-78224

NextGen Healthcare Mirth Connect is affected by an XXE injection vulnerability in the XSLT Transformer Step , which builds a bare TransformerFactory without proper security options set. This allows an unauthenticated network-based attacker to achieve high confidentiality impact (data exfiltration...

CVE-2026-78224 NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference

The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, so XXE injection can allow data exfiltration and denial-of-service attacks...

CVE-2026-78224 NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference

The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, so XXE injection can allow data exfiltration and denial-of-service attacks...

EUVD-2026-76116

The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, so XXE injection can allow data exfiltration and denial-of-service attacks...

CVE-2009-4118

CVE-2009-4118 Клиент Cisco VPN - Отказ в обслуживании из-за целочисленного переполнения Публикация на Exploit-DB: https://www.exploit-db.com/exploits/10190/ Официальное предупреждение Cisco Intelligence AlertID 19445 и авторы http://tools.cisco.com/security/center/viewAlert.x?alertId=19445 Автор...

PoC-CVE-2018-15473

PoC-CVE-2018-15473 OpenSSH до версии 7.7 подвержен уязвимости перечисления пользователей из-за того, что выход для недействительного пользователя не откладывается до полного разбора пакета, содержащего запрос, что связано с auth2-gss.c, auth2-hostbased.c и auth2-pubkey.c. CVE: CVE-2018-15473...

CVE-2026-89298

A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the view-clients role accesses the client registration endpoint to retrieve client details. Due to a failure to mask sensitive...

CVE-2026-89212

A flaw resulting in XML external entity XXE was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 including older unsupported versions of Akana and has been...