CVE-2022-51020

Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrfcookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke t...

CVE-2026-18529

The IBM Maximo Application Suite - Location Service for Esri Component versions 9.2 , 9.1 , and 9.0 are vulnerable to command injection (CWE-78). This is caused by the improper sanitisation of a user-controlled value passed to a shell command within a Kubernetes operator task . An attacker could ...

CVE-2026-18529 IBM Maximo Application Suite - Location Service for Esri Component Code Execution

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value passed to a shell command in a Kubernetes operator task...

EUVD-2026-97902

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value passed to a shell command in a Kubernetes operator task...

CVE-2022-51020 Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints

Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrfcookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke t...

EUVD-2022-56064

Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrfcookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke t...

CVE-2022-51020 Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints

Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrfcookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke t...

CVE-2022-51020

Flower versions before 2.2.0 are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability. The root cause is that Tornado xsrf_cookies is disabled and the OAuth session cookie lacks the SameSite attribute. An attacker can trick an authenticated user into visiting a malicious page that perf...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by a path traversal vulnerability due to Apache Ant

Summary Apache Ant is used by IBM Integrated Analytics System as a Java-based build and task execution tool. CVE-2026-78254 affects Apache Ant versions prior to 1.10.18, where the ftp and scp tasks allow a malicious server or a machine-in-the-middle attacker to provide relative paths during file...

PT-2026-110967

Name of the Vulnerable Software and Affected Versions IBM Maximo Application Suite - Location Service for Esri Component versions 9.0 through 9.2 Description Command injection is possible due to improper sanitization of a user-controlled value passed to a shell command within a Kubernetes operato...

CVE-2026-18529: Improper Neutralization of Special Elements used in an OS Command

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value passed to a shell command in a Kubernetes operator task...

secator

La navaja suiza del pentester. Características • Comandos soportados • Instalación • Uso • Documentación • ¡Únete a nosotros en Discord! secator es un ejecutor de tareas y flujos de trabajo utilizado para evaluaciones de seguridad. Soporta docenas de herramientas de seguridad conocidas y está...

turbinia

Turbinia Resumen Nota: Turbinia ya no desarrollará nuevas funcionalidades y se encuentra en modo de mantenimiento. Los usuarios deberían echar un vistazo aOpenRelik. Turbinia es un framework de código abierto para desplegar, gestionar y ejecutar cargas de trabajo forenses distribuidas. Su objetiv...

sh00t

A Testing Environment for Manual Security Testers Sh00t es un gestor de tareas para que te centres en realizar pruebas de seguridad proporciona listas de verificación Por Hacer de casos de prueba ayuda a crear informes de errores con plantillas de errores personalizables Características: Gestor d...

CVE-2026-108571

A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. This impacts the function kqjcmdModel::returnchuli of the file webmain/task/openapi/openkqjAction.php of the component Openkqj Action. This manipulation of the argument ID causes sql injection. The attack is possible to be carri...

pybeacon

PyBeacon PyBeacon es una colección de scripts para tratar con el tráfico cifrado de Cobalt Strike. Puede cifrar/descifrar metadatos de beacons, así como analizar tareas cifradas simétricamente. Scripts incluidos Hay una pequeña biblioteca que incluye métodos de cifrado/descifrado, sin embargo se...

CVE-2026-98292

A flaw was found in the Linux kernel's MediaTek Bluetooth drivers. The drivers fail to properly validate the length of incoming Wireless Management Task WMT event packets before accessing their data fields. A malicious or compromised device could transmit a truncated or malformed event, causing a...

PT-2026-110103

Name of the Vulnerable Software and Affected Versions Xinhu Rainrock RockOA versions prior to 2.7.7 Description A remote SQL injection exists within the Openkqj Action component. The issue occurs in the kqjcmdModel::returnchuli function located in the webmain/task/openapi/openkqjAction.php file. ...

CVE-2026-108571: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. This impacts the function kqjcmdModel::returnchuli of the file webmain/task/openapi/openkqjAction.php of the component Openkqj Action. This manipulation of the argument ID causes sql injection. The attack is possible to be carri...

Resource Exhaustion

code.vikunja.io/api is vulnerable to a resource exhaustion. The vulnerability is due to the lack of recursion depth limits for deeply nested filter expressions in the task-filter endpoint, which allows an authenticated attacker to submit thousands of nested parentheses in the filter query...