5920 matches found
CVE-2025-47176
CVE-2025-47176 PoC 브라우저 브리지 설명 이 개념 증명PoC은 CVE-2025-47176 취약점 시뮬레이션을 보여줍니다. 악성 동기화 경로가 포함된 조작된 메일 항목을 Outlook에 주입하여 스캔 중 작업을 트리거합니다. 중요: 이 PoC는 취약한 Outlook 경로 구문 분석을 시뮬레이션하며, 악성 경로가 감지되면 시스템 재시작 을 트리거합니다. malicious.prf를 사용한 추가 테스트 조작된 Outlook 프로필 파일malicious.prf을 가져와 이 PoC를 테스트할 수도 있습니다: 1...
Mailcow-CVE-2022-31245
Mailcow CVE-2022-31245 CVE-2022-31245: Mailcow를 위한 RCE 및 도메인 관리자 권한 상승. POC 포함. 보고 및 수정: 2022-05 패치된 버전: https://github.com/mailcow/mailcow-dockerized/releases/tag/2022-05d CVE: https://vulners.com/cve/CVE-2022-31245 CVE-2022-31245: 명령 주입, RCE 심각도: 3/3 유형: 명령 주입, RCE, 도메인 탈취 영향을 받는 버전: 최소 2019 -...
Azure File Sync Agent v23.1 Release – August 2026 (KB5072939)
Update Rollup for Azure File Sync agent version 23.1.0.0. For more details, see the associated Microsoft Knowledge Base article...
Azure File Sync Agent v23.1 Release – August 2026 (KB5072939)
Update Rollup for Azure File Sync agent version 23.1.0.0. For more details, see the associated Microsoft Knowledge Base article...
Azure File Sync Agent v23.1 Release – August 2026 (KB5072939)
Update Rollup for Azure File Sync agent version 23.1.0.0. For more details, see the associated Microsoft Knowledge Base article...
Azure File Sync Agent v23.1 Release – August 2026 (KB5072939)
Update Rollup for Azure File Sync agent version 23.1.0.0. For more details, see the associated Microsoft Knowledge Base article...
CVE-2026-12264
Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution...
EUVD-2026-88226
Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution...
CVE-2026-12264: Unrestricted Upload of File with Dangerous Type
Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution...
CVE-2026-100848
AzuraCast versions before 0.23.8 (specifically the azuracast/azuracast Composer package) are vulnerable to Server-Side Request Forgery (SSRF) . The root cause is that the software validates the "Remote Relay" URL only for syntax and scheme (http/https) via Utilitiesase\Urls::parseUserUrl, but fa...
CVE-2026-100848 AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL
AzuraCast Composer package azuracast/azuracast before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/https scheme Utilities\Urls::parseUserUrl, used by StationRemote::getUrlAsUri and performs no host or IP address restriction. A user holding only the station-scope...
EUVD-2026-87840
AzuraCast Composer package azuracast/azuracast before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/https scheme Utilities\Urls::parseUserUrl, used by StationRemote::getUrlAsUri and performs no host or IP address restriction. A user holding only the station-scope...
CVE-2026-100713 Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync
Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...
CVE-2026-100713 Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync
Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...
CVE-2026-100713 Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync
Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...
CVE-2026-57449
Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server'...
CVE-2026-57449 Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token
Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server'...
CVE-2026-57449
The Actual Sync Server (prior to version 26.7.0 ) is vulnerable to a CORS proxy allowlist bypass. When ACTUAL_GITHUB_TOKEN is configured, the server's CORS proxy uses a raw startsWith() prefix test to validate GitHub repositories against an official plugin allowlist. Because the check fails to re...
CVE-2026-57449 Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token
Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server'...
CVE-2026-57449 Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token
Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server'...