AlmaLinux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785885924)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785885924 advisory. - Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat...

Rocky Linux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785885924)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785885924 advisory. - Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat...

CentOS Linux 8.4 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1773134717)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1773134717 advisory. - When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a cross-protocol redirect to a second URL th...

CVE-2026-103001

A flaw was found in pyjwt. This vulnerability allows a remote attacker to bypass token validation checks when an application reuses an options configuration across multiple token decoding requests. Because the library unintentionally modifies the caller's shared configuration dictionary when...

cups-2.4.16-lpe

CUPS 2.4.16 — ローカル権限昇格 CVE-2026-34990 📋 概要 CUPS 2.4.16 にはローカル権限昇格 の脆弱性が含まれています （GHSA-c54j-2vqw-wpwp としても追跡されています）。 脆弱性 1. 誰でも書き込み可能なソケット — /run/cups/cups.sock が誰でも書き込み可能であり、 任意のローカルユーザーが CUPS デーモン（root として実行中）に IPP リクエストを送信できます。 2. ローカルトークンの漏洩 — CUPS-Create-Local-Printer を悪用し、 device-uri を攻撃者が制御す...

CVE-2026-34990

CVE-2026-34990 — CUPS ローカル権限昇格（cups2root、デハーネス版） CVSS 3.x : 8.4 HIGH 概算 — 要検証 CWE : CWE-287 不適切な認証 + CWE-269 不適切な権限管理 Fix : CUPS 2.4.17+ Affects : CUPS ≤ 2.4.16 で cupsd が root として動作し、631 がローカルから到達可能な場合 root で動作する cupsd に対するローカル権限昇格。悪意のあるローカルサーバに対して IPP クライアント として動作するよう強制されると、cupsd は 401...

CVE-2026-34990

CVE-2026-34990 説明 CVE-2026-34990 - OpenPrinting CUPS バージョン 2.4.16 以前において、ローカルの非特権ユーザーが cupsd を騙して、攻撃者が制御する localhost の IPP サービスに対して、再利用可能な Authorization: Local ... トークンを用いて認証させることが可能です。このトークンは localhost 上の /admin/ リクエストを実行するのに十分であり、攻撃者は CUPS-Create-Local-Printer と printer-is-shared=true...

CVE-2023-54402

The software iDocView is vulnerable to a Server-Side Request Forgery (SSRF) flaw in its /doc/upload endpoint. Remote unauthenticated attackers can bypass authentication by using a hardcoded default token value (testtoken ) to fetch arbitrary URLs. Due to unrestricted URL scheme handling, includin...

CVE-2024-27198_Lab

CVE-2024-27198Lab Vulnerability Research & Purple Team Demonstration Lab for JetBrains TeamCity Authentication Bypass CVE-2024-27198 Table of Contents About The Project CVE Details Built With Threat Intelligence & OSINT Real-World Impact & Exploitation Why this CVE is Critical Getting Started...

HITCON-2023-Demo-CVE-2023-20562

HITCON 2023 데모 CVE-2023-20562 설명 이 시연은 대만에서 열린 HITCON 2023에서 진행되었습니다. 이 데모는 AMD μProf 내 AMDCpuProfiler.sys의 취약점 악용을 강조합니다. EPROCESS 토큰에 임의 쓰기를 트리거하여 SYSTEM 수준으로 권한 상승을 달성합니다. DSE 플래그를 비활성화하면 악성 서명되지 않은 드라이버를 로드할 수 있습니다. 발표에서는 또한 360 Total Security의 ObRegisterCallbacks를 무효화하여 360 Total Security의...

CVE-2025-63314

CVE-2025-63314 - Acora CMS의 비밀번호 재설정 토큰 부적절 처리 Crowe India의 Joby Y Daniel이 발견함 📌 개요 DDSN Interactive cm3 Acora CMS 버전 10.7.1 은 비밀번호 재설정 기능에 보안 취약점을 포함하고 있습니다. 애플리케이션은 정적이고 지속적인 비밀번호 재설정 토큰을 사용하며, 이 토큰은 사용 후 무효화되지 않고 시간이 지나도 만료되지 않습니다. 이 결함으로 인해 유효한 재설정 토큰을 획득한 공격자가 해당 토큰을 무기한 재사용할 수 있으며, 이는 권한 있는...

CVE-2026-20896

개념 증명 코드 CVE-2026-20896 이 스크립트는 Gitea API 경로 검증의 논리적 결함을 자동으로 악용하여, 인증 헤더의 디렉토리 탐색 공격을 통해 서버가 유효한 관리자 토큰을 부여하도록 강제합니다. !/usr/bin/env python3 PoC: Gitea Authentication Bypass CVE-2026-20896 Uso exclusivo para entornos controlados y auditorías autorizadas CTF import requests import sys import...

CVE-2026-103321 MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image

MISP contains a stored cross-site script XSS vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string...

CVE-2018-15133-laravel-framework

CVE-2018-15133 - Laravel 프레임워크5.6.x 취약점 실습 환경 이 저장소는 CVE-2018-15133APPKEY를 알 때 Laravel 프레임워크 토큰 역직렬화 RCE을 재현할 수 있는 Docker 실습 환경을 제공합니다. 애플리케이션은 취약한 Laravel 5.6.x 버전으로 고정되어 있으며, web 미들웨어 그룹 아래에 간단한 /poc POST 라우트를 노출하여 CSRF 토큰 파싱이 트리거되도록 되어 있습니다. 빠른 시작 docker compose up -d --build 열기:...

CVE-2025-69516

CVE-2025-69516 - Tactical RMM リモートコード実行 このリポジトリには、Tactical RMM の CVE-2025-69516 SSTI 脆弱性の悪用を自動化する Python スクリプトが含まれています。バージョン 1.3.1 でテストされています。 使用方法 python xpl.py -d api.tactical.xyz -t SESSIONTOKEN -c "id" リンク https://vulners.com/cve/CVE-2025-69516...

kit-oauth

kit-oauth OAuth 2.0 client library for Kit applications TOC Files File| Description ---|--- .editorconfig| Editor formatting configuration .gitignore| Git ignore rules for build artifacts and dependencies .tool-versions| asdf tool versions Zig, Kit LICENSE| MIT license file README.md| This file...

CVE-2026-97966

A flaw was found in the Linux kernel's Marvell OCTEON TX2 network driver. When tearing down Hierarchical Token Bucket HTB quality-of-service queues, the driver fails to clear hardware scheduler topology configurations before returning queues to the shared pool. A local user with network...

openclaw-hardening-check

이 스크립트는 읽기만 수행합니다. 아무것도 수정하지 않으며, 안전함을 보장하지 않습니다. 녹색 출력은 아래 나열된 검사만 통과했음을 의미하며 그 이상은 아닙니다. OpenClaw 보안 강화 점검 openclaw-hardening-check.mjs는 의존성이 없고 오프라인에서 동작하는 작은 도구로, OpenClaw 설치 환경을 검토합니다. 로컬 설정, 패키지 메타데이터, 플러그인 및 스킬 매니페스트, 파일 모드, 그리고 Linux에서는 실행 중인 Gateway의 /proc 항목을 읽습니다. 파일을 변경하거나, OpenClaw 명...

CentOS Linux 8.5 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1773135327)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1773135327 advisory. - When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a cross-protocol redirect to a second URL th...

Linux Distros Unpatched Vulnerability : CVE-2026-102275

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.fromjwk in jwt/algorithms.py is affected because...