Malicious code in @hrmony/pladddform-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81b9c27ba35a6978a0731d77b7d5fec367f4c2a8b4acc5838588071c89886fa4 On require/import, index.js performs three attacker-benefiting actions against a hardcoded endpoint at https://hrnmn.dd.h4x.tv/. First, it POSTs an...

MAL-2026-17272 Malicious code in @hrmony/pladddform-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81b9c27ba35a6978a0731d77b7d5fec367f4c2a8b4acc5838588071c89886fa4 On require/import, index.js performs three attacker-benefiting actions against a hardcoded endpoint at https://hrnmn.dd.h4x.tv/. First, it POSTs an...

CVE-2021-4034

CVE-2021- Se encontró una vulnerabilidad de escalada de privilegios local en la utilidad pkexec de polkit. La aplicación pkexec es una herramienta setuid diseñada para permitir que usuarios no privilegiados ejecuten comandos como usuarios privilegiados según políticas predefinidas. La versión...

Amazon Linux 2023 : libssh, libssh-config, libssh-devel (ALAS2023-2026-3096)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3096 advisory. A flaw was found in libssh. A remote authenticated client can issue SSHFXPREAD requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and...

SUSE CVE-2026-79678

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

CVE-2024-6678

CVE-2024-6678 - GitLab: Disparo Arbitrario de Usuario en Pipeline Schedule PoC para CVE-2024-6678 Descripción de la vulnerabilidad GitLab permite a los usuarios ejecutar manualmente las programaciones de pipelines de CI/CD Pipeline Schedules mediante el botón «Play». La vulnerabilidad consiste en...

CVE-2023-28432

CVE-2023-28432 Plantillas de nuclei para CVE-2023-28432 Descripción Minio es un framework de almacenamiento de objetos Multi-Cloud. En un despliegue en clúster, a partir de RELEASE.2019-12-17T23-16-33Z y antes de RELEASE.2023-03-20T20-16-18Z, MinIO devuelve todas las variables de entorno, incluid...

Shellshock_CVE-2014-6271

Shellshock CVE-2014-6271 Shellshock docker-compose.yml, poc.py 파일을 다운 받아 주세요 반드시 pip install requests 를 통해 requests 라이브러리를 다운받아 주세요!!! uv를 사용하시는 분들은 uv를 통해 requests 라이브러리를 venv 안에 넣어주세요!!! CVE Official Description --- In GNU Bash versions prior to 4.3, there was a problem with handling strings th...

CVE-2021-4034

CVE-2021-4034 Esto contiene un exploit de un solo archivo para cve-2021-4034, que es una escalada de privilegios local de Polkit. ¡Úsalo con sabiduría! Descripción de la vulnerabilidad CVE-2021-4034, comúnmente conocida como Pwnkit , es una vulnerabilidad de corrupción de memoria en el componente...

shellshock-cve-lab

Shellshock CVE-2014-6271 lab This repository contains a small CGI lab for CVE-2014-6271. It compiles GNU bash 4.2, serves a CGI script through a Python RFC-3875-style server, and maps request headers into CGI environment variables. Sentinel reproduced this scenario on 2026-08-27 as a from-scratch...

CVE-2014-6271

🚨 CVE-2014-6271 — «Shellshock» Vulnerabilidad de Ejecución Remota de Código de Día Cero de 25 Años en GNU Bash mediante Variables de Entorno 📖 Resumen CVE-2014-6271 , apodado Shellshock también conocido como Bashdoor, es una vulnerabilidad crítica de ejecución remota de código RCE en el intérpret...

CVE-2026-101043

A flaw was found in pnpm. This vulnerability can lead to information disclosure because proxy settings defined in workspace configuration files expand environment variable placeholders without proper restrictions. An attacker who convinces a user or automated system to run a command within a...

EUVD-2026-87974

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand $VAR environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the...

CVE-2026-101032 navi through 2.24.0 OS Command Injection via Cheatsheet Variables

navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted file names in suggestion command directories to execute arbitrary commands with victim privileges...

CVE-2026-101032 navi through 2.24.0 OS Command Injection via Cheatsheet Variables

navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted file names in suggestion command directories to execute arbitrary commands with victim privileges...

CVE-2026-101032

The navi tool (versions through 2.24.0 ) is vulnerable to OS Command Injection due to a failure to properly escape cheatsheet variable values during shell command substitution. An attacker can achieve arbitrary command execution with victim privileges by injecting shell metacharacters through cra...

CVE-2026-101032 navi through 2.24.0 OS Command Injection via Cheatsheet Variables

navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted file names in suggestion command directories to execute arbitrary commands with victim privileges...

CVE-2023-28432

Explotación de vulnerabilidad en MinIO CVE-2023-28432 Descripción Este script en python3 está diseñado para explotar CVE-2023-28432, que potencialmente afecta a ciertas configuraciones del servidor MinIO. El script realiza una solicitud POST a un hostname especificado, intentando recuperar...

virt-firmware

Herramientas para volúmenes de firmware ovmf / armvirt Esta es una pequeña colección de herramientas para imágenes de firmware edk2. Permiten decodificar e imprimir el contenido de volúmenes de firmware. Los almacenes de variables OVMFVARS.fd se pueden modificar, por ejemplo para inscribir...

CVE-2026-101043: Insertion of Sensitive Information Into Sent Data

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand $VAR environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the...