CVE-2026-56423-MISP-deleteSelection-BrokenAccessControl

CVE-2026-56423 — MISP deleteSelection Broken Access Control Proof of concept for a missing-authorization flaw in MISP's bulk deletion flows for Event Reports and Sharing Groups. The deleteSelection handlers authorize each selected item with a callback that ignores the item and returns the caller'...

CVE-2006-3592

CVE-2006-3952 适用于Win7 32位系统的Easy File Sharing FTP Server 3.5利用程序 基于： pwntools msfvenom / reversetcp payload 脆弱应用下载地址：https://www.exploit-db.com/apps/0efddb6d04f4125d7c1f104c6b1c60a0-efsfs.exe 简单的SEH覆盖 + 几次向后跳转，因为SEH值之后堆栈被破坏。...

enseal

enseal 为开发者提供安全、临时的秘密分享。 别再在 Slack 上粘贴秘密了。enseal 让安全路径比不安全路径更快——通过一条命令和零配置，即可通过加密的一次性通道分享 .env 文件和秘密。bash sender $ enseal share .env Share code: 7-guitarist-revenge Secrets: 14 variables staging Expires: on first receive recipient $ enseal receive 7-guitarist-revenge ok: 14 secrets written to .en...

CVE-2026-65400-poc

CVE-2026-65400 — Lectura de ficheros root pre-autenticación en Compartir Pantalla de macOS PoC de solo lectura Prueba de concepto de solo lectura. Demuestra la omisión de autenticación leyendo un fichero solo-root de un host vulnerable. No escribe nada en el objetivo: ni LaunchDaemon, ni archivo ...

CVE-2024-37742

CVE-2024-37742: Exploit de Portapapeles en SEB ≤ 3.5.0 Windows Este repositorio contiene una prueba de concepto PoC para explotar CVE-2024-37742, una vulnerabilidad en Safe Exam Browser SEB ≤ 3.5.0 en Windows. La vulnerabilidad permite a un atacante compartir datos del portapapeles entre el modo...

RpcAuthnLevelPrivacyEnabled

管理针对CVE-2021-1678（KB4599464）的RPC打印机关联更改部署 Windows打印机共享错误，请下载并执行：https://github.com/alvaciroliveira/RpcAuthnLevelPrivacyEnabled/blob/main/RpcAuthnLevelPrivacyEnabled.reg...

jenkinsci__workflow-cps-global-lib-plugin_CVE-2022-25174_544-vff04fa68714d

Pipeline 共享库 当你有多个 Pipeline 作业时，你通常希望在不同作业之间共享部分 Pipeline 脚本，以保持 Pipeline 脚本的 DRY 原则。一个非常常见的场景是你有多个以相似方式构建的项目。 该插件通过允许你创建 "共享库脚本" SCM 仓库来添加这一功能。它可以通过两种模式使用： 一种传统模式，其中存在一个由 Jenkins 自身托管的单一 Git 仓库，你可以向其中推送更改。 一种更通用的模式，你可以在你选择的任何位置定义由任何 SCM 托管的库。 完整的用户文档可以在 用户手册的 Pipeline 章节 中找到。...

CVE-2018-18912

🐞 CVE-2018-18912：Easy File Sharing Web Server 7.2 - 基于栈的缓冲区溢出（SEH） Easy File Sharing Web Server 7.2 中的基于 SEH 的缓冲区溢出，演示经过身份验证的 HTTP POST 参数如何破坏异常处理程序链。 📑 目录 为什么这个仓库存在 为什么这个漏洞有趣 背景和受影响的软件 关于漏洞 触发崩溃 漏洞利用 🎓 为什么这个仓库存在 这个仓库是我在讲授内存损坏漏洞利用时使用的教学材料的一部分（除了日常工作外，我还在不同的网络安全课程中授课，帮助培养下一代逆向工程师）。 CVE-2018-18912...

Langflow AI <= 1.6.9 - CORS Misconfiguration

Langflow AI versions 1.6.9 and earlier are vulnerable to a CORS misconfiguration that allows any origin to make credentialed requests. Combined with SameSite=None cookies, this enables cross-origin token theft and subsequent remote code execution via the /api/v1/validate/code endpoint. id:...

com.github.luben/zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing

A flaw was found in luben zstd-jni. This flaw involves a use-after-free vulnerability in the ZstdCompressCtx.loadDict function, which handles dictionary sharing. A remote attacker could exploit this by manipulating dictionary sharing operations, potentially leading to denial of service, informati...

CVE-2026-75973

Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web...

UBUNTU-CVE-2026-75973

Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web...

CVE-2026-75973

Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web...

CVE-2026-95697 MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata

MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group SG edit...

CVE-2026-95671

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

EUVD-2026-84380

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

CVE-2026-95671 MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

CVE-2026-95671 MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

CVE-2026-95671

CVE-2026-95671 affects MISP (Malware Information Sharing Platform). The CollectionsController add() method only enforced the sharing-group authorization check for POST requests, while the underlying CRUDComponent::add() persists data on both POST and PUT requests. An authenticated user could ther...

CVE-2026-95671: Missing Authorization

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...