retryabledns

Retryable dns resolver Based on miekg/dns and freely inspired by bogdanovich/dnsresolver. Features Supports both system default DNS resolvers and user-provided ones Retries DNS requests in case of I/O errors, timeouts, or network failures Allows arbitrary query types Resolution with random...

dnsx

A fast and multi-purpose DNS toolkit designed for running DNS queries Features • Installation • Usage • Running dnsx • Wildcard • Notes • Join Discord dnsx is a fast and multi-purpose DNS toolkit designed for running various probes through the retryabledns library. It supports multiple DNS querie...

CVE-2016-2098

CVE-2016-2098 レンダリングにユーザー提供データを使用する際のRuby-on-Railsにおけるリモートコード実行脆弱性。 説明: この問題は、ユーザー提供データに対してrenderメソッドを使用することに起因します。 renderメソッドは通常、テンプレートからページをレンダリングするために使用されますが、renderメソッドはプレーンテキスト（plaintext）やインラインコード（inline）のレンダリングも開発者に許可します。 render関数: File actionpack/lib/abstractcontroller/rendering.rb, line 23...

OpenCATS - Open Redirect

OpenCATS contains an open redirect vulnerability due to improper validation of user-supplied GET parameters. This, in turn, exposes OpenCATS to possible template injection and obtaining sensitive information, modifying data, and/or executing unauthorized operations. id: CVE-2023-27292 info: name:...

Moodle LTI module Reflected - Cross-Site Scripting

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's brows...

Gradio - Open Redirect

An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting XSS, Server-Side Request Forgery SSRF, amongst others. This...

CVE-2016-2098-my-first-exploit

CVE-2016-2098-my-first-exploit このエクスプロイトは、Ruby-on-Railsにおいて、ユーザーが提供したデータに対してrenderを使用する際のリモートコード実行脆弱性です。 Python3で書かれており、requestsライブラリをインストールすることを忘れないでください。以下がコマンドです。 pip3 install requests...

CVE-2025-65264

CVE-2025-65264 説明 CPU‑Z 2.17 以前（および CPU-Z ドライバ バージョン 1.0.6.1 以前を使用する他の製品）では、ドライバ（例：cpuz161.sys）がユーザー指定のアドレスの値を逆参照し、呼び出し元が指定したシステムバッファに書き込んでいました。攻撃者は入力バッファに対象アドレスを指定することで、IOCTL 経由で任意のカーネルメモリを読み取ることができました。 PoC これは System プロセスのトークンを読み取るシンプルな PoC です。 影響...

Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager - Remote Code Execution

Cisco Prime Infrastructure PI and Cisco Evolved Programmable Network EPN Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An...

Samsung rlottie Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung rlottie. Interaction with the rlottie library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the rlotti...

CVE-2026-20350

A vulnerability in the web-based management interface of Cisco ThousandEyes Virtual Appliance could allow an authenticated, remote attacker to inject arbitrary operating system commands. This vulnerability is due to improper validation of user-supplied input to the web-based management interface...

CVE-2026-89858 scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound image count in qla2x00updatefruversions qla2x00updatefruversions copies the user-supplied BSG request into a fixed 256-byte stack buffer bsgDMAPOOLSIZE and then iterates list-count times over the...

EUVD-2026-80177

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remot...

CVE-2026-11929

IBM Security Verify Identity Access Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Input: MT – limits the maximum number of slots. The syzbot reports an overly large allocation at inputmtinitslots. The number of slots is provided from the user space using ioctlUIDEVCREATE. Since no one knows the possible maximu...

CLEANSTART-2026-ED42524 Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded...

Multiple security vulnerabilities affect the spring-boot package. Applications which accept user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack if the evaluation of a SpEL expression triggers unbounded cache growth. See references for...

PT-2026-89658

An information disclosure vulnerability in the SAML Single Sign-On SSO functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could...

UBUNTU-CVE-2026-74859

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...

EUVD-2026-70822

There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read outside the bounds of an allocated data structure. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue...

CVE-2026-64195

CVE-2026-64195 is an out-of-bounds write vulnerability in DASYLab (by MEAS X), caused by insufficient validation of user-supplied data when parsing a .DSB file . Successful exploitation requires a user to open a specially crafted .DSB file. All versions before 2026.0.0 are affected; updating to 2...