CVE-2025-55887

CVE-2025-55887 Descrizione Una vulnerabilità di Cross-Site Scripting XSS è stata scoperta nel servizio di prenotazione pasti ARD. La vulnerabilità esiste nel parametro GET transactionID nella pagina di conferma della transazione. A causa di una convalida dell'input e di una codifica dell'output...

CVE-2025-48593

CVE-2025-48593: Esecuzione di codice remoto zero-click nel sistema Android Autore: LAKSHMIKANTHAN K letchupkt Data: novembre 2025 Gravità: Critica Una vulnerabilità critica di esecuzione di codice remoto zero-click che colpisce i dispositivi Android 13-16. Panoramica della vulnerabilità Attributo...

CVE-2025-11170

CVE-2025-11170 WP移行専用プラグイン for CPI = 1.0.2 - Caricamento Arbitrario di File non Autenticato 🚀 WP移行専用プラグイン for CPI = 1.0.2 - Caricamento Arbitrario di File non Autenticato 📝 Descrizione Il plugin WP移行専用プラグイン for CPI per WordPress è vulnerabile a caricamenti arbitrari di file a causa della mancanza...

CVE-2023-46604-Analysis

Analisi di CVE-2023-46604 Repository tecnico di analisi che riassume le cause, il percorso del codice, i punti di patch e i risultati della riproduzione della vulnerabilità Apache ActiveMQ CVE-2023-46604. Questo documento è materiale didattico per l'analisi tecnica e la difesa dalla vulnerabilità...

CVE-2026-41012

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualization infrastructure takeover. An attacker who can...

CVE-2026-41012 BOSH vSphere CPI Improper Cert Validation

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualization infrastructure takeover. An attacker who can...

EUVD-2026-68038

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualization infrastructure takeover. An attacker who can...

CVE-2026-41012

CVE-2026-41012 is a traffic interception vulnerability in BOSH Director vSphere CPI (all versions prior to v98.0.6 ) caused by insufficient certificate validation and pinning in the communication between BOSH Director and vCenter. An attacker positioned between the two can impersonate the vCenter...

EUVD-2025-210810

IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation...

EUVD-2025-210809

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...

EUVD-2026-66215

Kimai before 2.62.0 fails to validate createothertimesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with viewothertimesheet and editothertimesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassin...

Linux Distros Unpatched Vulnerability : CVE-2026-73208

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the...

PT-2026-83455

Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypass IP validation. Attackers can make the server request internal hosts in that range including cloud metadata services and read...

PT-2026-83429

Name of the Vulnerable Software and Affected Versions BookStack versions prior to 26.05.4 Description An authenticated remote code execution issue exists in the portable ZIP import functionality. Users possessing both Import Content and Create Books permissions can upload a PHP-image polyglot...

Linux Distros Unpatched Vulnerability : CVE-2026-40205

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the...

Linux Distros Unpatched Vulnerability : CVE-2026-56854

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and...

SeeProxy

SeeProxy Proxy inverso in Golang con validazione del profilo malleabile CobaltStrike. La premessa di questo strumento è di non esporre il tuo teamserver al mondo ma a una singola istanza di SeeProxy. In questo modo ogni richiesta che raggiunge il tuo teamserver è traffico C2 legittimo. Esempio di...

RestrictedPython guard hooks can be shadowed via positional-only arguments

Impact RestrictedPython rewrites sensitive operations to go through guard hooks. Attribute access becomes getattrobj, name, item access becomes getitemobj, key, writes go through write, and print goes through print. The embedding application supplies these hooks to enforce its policy. Argument-na...

CVE-2025-54123

CVE-2025-54123 Panoramica Esecuzione remota di codice autenticata nell'endpoint API middleware di HoverFly a causa di una convalida dell'input insufficiente e di un'esecuzione di comandi non sicura. Flusso di attacco 1. Autenticazione L'attaccante si autentica su HoverFly utilizzando credenziali...

CVE-2025-36290

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...