72 matches found
CVE-2024-3094
CVE-2024-3094 在 xz 的上游 tarball 中发现恶意代码，自 5.6.0 版本开始。通过一系列复杂的混淆手段，liblzma 构建过程从源代码中一个伪装的测试文件中提取出预构建的目标文件，并利用该文件修改 liblzma 代码中的特定函数。 这导致 liblzma 库被修改，任何与该库链接的软件均可利用此库，拦截并修改与该库的数据交互。本仓库提供两个快速脚本，用于检查您的 Kubernetes Pod 和 Docker 容器是否受到易受攻击的最新版本 liblzma5（5.6.0 或 5.6.1）的影响。...
malicious-pdf
Malicious PDF Generator ☠️ Generate 67 malicious PDF test files for testing phone-home callbacks, SSRF, XSS, XXE, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh Used for penetration testing, bug bount...
xzutils_backdoor_obfuscation
xzutilsbackdoorobfuscation 此脚本复现了 XZ utils 攻击（CVE-2024-3094）所使用的混淆技术。 它仅在 xzutils v5.6.0 上经过测试。 ⚠️ 此代码仅供教育目的使用，不应被用于恶意活动。风险自负。 ⚠️ 前提条件 你的工作目录中必须包含来自 xzutils 5.6.0 的原始 good-largecompressed.lzma 文件。 使用方法 运行以下命令： ./obfuscatepayload.sh yourpayload 将生成一个 good-largecompressed.lzma.modified 文件，你需要将其放入...
CVE-2026-18958 imranrisal-dev Student-Management-System Login loginCheckTest.php sql injection
A vulnerability was detected in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. Affected by this vulnerability is an unknown functionality of the file loginCheckTest.php of the component Login. The manipulation of the...
skopeo security update
1:1.22.2-6 - Rebuild for CVE-2026-32283 - Resolves: RHEL-167688 1:1.22.2-5 - Rebuild for CVE-2026-25679 - Re-add test file installation to fix tier0 tests - Resolves: RHEL-158789...
CVE-2026-56342
AVideo
Missing Authorization
Overview @vitest/browser is a Browser running for Vitest Affected versions of this package are vulnerable to Missing Authorization through the api and browser.api request handlers in the server and UI components. An attacker can run tests, modify project files, or overwrite snapshots by connectin...
GHSA-5XRQ-8626-4RWP When Vitest UI server is listening, arbitrary file can be read and executed
Summary Arbitrary file can be read on Windows when Vitest UI server is listening, especially when exposed to the network. Impact Only users that match either of the following conditions are affected: - explicitly exposes the Vitest UI server to the network using --api.host or api.host config opti...
CVE-2026-9302
546669204 vps-inventory-monitoring (VpsTest Console) is affected via the VpsTest.php file’s eval usage. The vulnerability arises from manipulating the argument vf in the function eval, allowing remote code execution. Public exploit exists. The project uses a rolling release, and the CVE record do...
vps-inventory-monitoring 代码注入漏洞
vps-inventory-monitoring is a web inventory monitoring tool developed by individual developer 546669204. vps-inventory-monitoring has a code injection vulnerability, which stems from the use of the eval function in the VpsTest Console component file app/index/command/VpsTest.php, specifically...
WWBN AVideo 操作系统命令注入漏洞
WWBN AVideo is a video platform building system developed by the WWBN team using PHP. Versions of WWBN AVideo prior to 29.0 contained an operating system command injection vulnerability. This vulnerability stemmed from incomplete repairs in the test.php file, which did not clean up the...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an arbitrary code execution in Python-Future [CVE-2025-50817]
Summary IBM Watson Speech Services Cartridge is vulnerable to an arbitrary code execution in Python-Future, due to the unintended import of a file named test.py. CVE-2025-50817. Python-Future is used in our service runtimes. This vulnerabilitiy has been addressed. Please read the details for...
GHSA-45H5-66JX-R2WF MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827
MJML before 5.0.0-alpha.9 allows mj-include directory traversal to test file existence and in the type="css" case read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827...
SUSE SLED15 / SLES15 Security Update : python-future (SUSE-SU-2025:03049-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:03049-1 advisory. - CVE-2025-50817: Fixed arbitrary code execution via the automatic import of file test.py bsc1248124 Tenable has...
CVE-2025-67898
MJML through 4.18.0 allows mj-include directory traversal to test file existence and in the type="css" case read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827...
CVE-2025-14673 gmg137 snap7-rs client.rs as_ct_write heap-based overflow
A vulnerability has been found in gmg137 snap7-rs up to 1.142.1. Affected is the function snap7rs::client::S7Client::asctwrite of the file /tests/snap7-rs/src/client.rs. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to t...
EUVD-2019-2177
Malware in sbrugna...
EUVD-2019-5246
Malware in sbrugna...