-nginxui_discover

Nginx UI ディスカバリースキャナー - CVE-2026-27944 バージョン検出ツール https://img.shields.io/badge/python-3.6+-blue.svg https://img.shields.io/badge/license-MIT-green https://img.shields.io/badge/threading-multi--threaded-brightgreen 著者: NULL200OK Nginx UI Webインターフェースを発見し、そのバージョンを検出し、CVE‑2026‑27944（バージョン ≤...

ServiceNow-CVE-2025-11449-CVE-2025-11450-Mitigation-Script

ServiceNow CVE-2025-11449 & CVE-2025-11450 緩和スクリプト 概要 このスクリプトは、ServiceNow UI Macros における CVE-2025-11449 および CVE-2025-11450 のセキュリティ脆弱性を自動的に検出し、修復します。これらの脆弱性は、ユーザー制御の sysparm パラメータが適切にサニタイズされていない場合、特別に細工されたリンクを通じてユーザーのブラウザで任意のコード実行を引き起こす可能性があります。 影響を受ける UI Macros $pwdverifyemail...

CVE-2026-73296

🚨 CVE-2026-73296 - UFO-Vuln 💥 認証されていないMobile MCPアクセスにより、Android画面データが露出し、ADBを介したリモートUI制御機能が提供される可能性があります。 ⚠️ セキュリティ通知 このリポジトリは、許可されたセキュリティ研究、脆弱性検証、防御的テスト、および管理された実験室環境のみを対象としています。 同梱のチェッカーは、非破壊的な認証境界チェック を実行するように設計されています。 以下のことは行いません ： 任意のMCPツールの実行 Androidデバイスの制御 実デバイスに対するADBコマンドの実行 スクリーンショットの取得...

Claude-Code-MCP-Injection-PoC

Claude Code: MCP 도구 확인 프롬프트 왜곡 Anthropic의 Claude Code에서 중요한 UI/UX 결함을 입증하는 전문적인 개념 증명PoC입니다. 이 취약점은 악의적인 MCP 서버가 확인 프롬프트에서 도구 매개변수를 잘못 표현하여 사용자가 임의의 명령 실행을 승인하도록 속일 수 있게 합니다. 🛡️ 기술 요약 Claude Code는 MCP 서버가 제공하는 설명과 메타데이터를 신뢰하여 사용자에게 표시되는 확인 프롬프트를 생성합니다. 공격자가 제어하는 서버는 무해한 설명예: "파일 읽기"을 제공하면서 기본 실행...

CVE-2026-18058

The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. When paired with a phishing attack, this manipulation could result in escalated privileges of an attacker within the system...

CVE-2026-18058

The mobile Smart Connect dashboard UI (referenced via Motorola support, with CNA from Lenovo PSIRT ) was vulnerable to manipulation by third-party apps . When combined with a phishing attack , this manipulation could lead to privilege escalation for an attacker within the system. The vulnerabilit...

CVE-2026-18058

The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. When paired with a phishing attack, this manipulation could result in escalated privileges of an attacker within the system...

K000161728: BIG-IP Configuration utility vulnerability CVE-2026-63020

Security Advisory Description A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages. CVE-2026-63020 Impact An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in...

SUSE CVE-2026-84330

UI misrepresentation in FullScreen in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-84356

UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. Chromium security severity: Low...

CVE-2026-19219

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to alter the folders the file browser reads from, writes to,...

CVE-2026-4692-trust-me-im-in-rdm

CVE-2026-4692 — コンテンツプロセスが自身をRDMとして宣言できる BrowsingContextフィールド同期における認可チェック欠落の概念実証: 侵害されたコンテンツプロセスが、自身のトップレベルBrowsingContextに対して InRDMPane = true を設定する PContent::CommitBrowsingContextTransaction メッセージを偽造し、親プロセスがそれを適用してしまう 。 対象: Firefox 149.0a1 nightly @ 2fbc0748c4脆弱、修正前、macOS arm64。 Firefox 149で修正 ...

CVE-2022-33891-EXPLOIT

CVE-2022-33891 - Apache Spark UI 원격 코드 실행 RCE 🔐 Apache Spark UI는 CVE-2022-33891로 식별된 원격 명령 주입 취약점에 취약합니다. 이 결함은 사용자 인증 및 접근 제어의 부적절한 처리, 특히 ACLAccess Control Lists이 활성화된 경우에 발생합니다. spark.acls.enable 구성 옵션을 통해 ACL이 활성화되면 인증 필터는 사용자가 애플리케이션을 보거나 수정하는 데 필요한 권한이 있는지 확인해야 합니다. 그러나 HttpSecurityFilter 내...

CVE-2026-19219

In Progress® Telerik® UI for AJAX (ASP.NET AJAX) prior to v2026.3.812 contains a vulnerability in the RadEditor file browser (DialogHandler UploadPaths). The root cause is insufficient integrity protection of dialog request parameters, which may allow an attacker who has obtained certain applicat...

CVE-2026-19219 DialogHandler UploadPaths Tampering Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to alter the folders the file browser reads from, writes to,...

EUVD-2026-69898

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to alter the folders the file browser reads from, writes to,...

CVE-2026-18672 RadImageEditor ClientState Unauthenticated Arbitrary File Read Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories...

EUVD-2026-69897

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories...

CVE-2026-18672

CVE-2026-18672 affects Progress Telerik UI for AJAX prior to v2026.3.812 . The vulnerability resides in the RadImageEditor control, where insufficient validation of client-supplied state allows an unauthenticated, network-based attacker to manipulate which file the control's image cache returns, ...

CVE-2025-492025

CVE-2025-492025 보안 권고: CVE-2025-492025 요약 Copilot AI에서 웹 쿼리를 검색할 때마다 "링크 소스link source" 섹션에 의도하지 않은 하이퍼링크가 포함되는 취약점이 확인되었습니다. 이 문제로 인해 사용자는 주제와 무관한 경우에도 https://www.collectingflags.com 링크를 클릭하게 되어, 잘못된 정보를 제공하거나 의도하지 않은 탐색을 유발할 수 있습니다. 영향을 받는 소프트웨어 현재 배포된 모든 CoPilot 인스턴스 취약점 세부 정보 CVE-ID:...