unSafe.sh - 不安全
我的收藏
今日热榜
公众号文章
导航
Github CVE
Github Tools
编码/解码
文件传输
Twitter Bot
Telegram Bot
Search
Rss
黑夜模式
Multiple vulnerabilities in the web management interface of Intelbras routers
Intelbras路由器的网络管理界面存在多个安全漏洞，包括跨站脚本（XSS）攻击和未认证访问问题。这些漏洞可能使攻击者获取管理员权限、控制设备或窃取敏感配置信息。...
2025-7-20 06:19:44 | 阅读: 36 |
收藏
|
Full Disclosure - seclists.org
hnap1
envelope
network
Missing Critical Security Headers in OpenBlow
OpenBlow whistleblowing软件缺少关键HTTP安全头（如CSP、Referrer-Policy等），导致XSS、点击劫持等风险。CVSS评分8.2（高危）。...
2025-7-13 03:13:59 | 阅读: 12 |
收藏
|
Full Disclosure - seclists.org
security
openblow
referrer
SAP NetWeaver S/4HANA - ABAP Code Execution via Internal Function
...
2025-7-11 12:18:10 | 阅读: 14 |
收藏
|
Full Disclosure - seclists.org
nullfaktor
security
developer
ddic
actvt
Tiki Wiki CMS Groupware <= 28.3 Two Server-Side Template Injection Vulnerabilities
Tiki Wiki CMS Groupware存在两个服务器端模板注入漏洞（SSTI），影响多个旧版本。攻击者可通过创建特定Wiki页面利用漏洞，在服务器上写入恶意PHP文件或执行系统命令。建议升级到最新版本修复问题。...
2025-7-10 02:57:1 | 阅读: 23 |
收藏
|
Full Disclosure - seclists.org
wiki
tiki
00search
php
KL-001-2025-011: Schneider Electric EcoStruxure IT Data Center Expert Unauthenticated Server-Side Request Forgery
Schneider Electric EcoStruxure IT Data Center Expert版本8.3及以下存在未认证服务器端请求伪造漏洞（SSRF），攻击者可利用该漏洞向任意位置发送数据或与未暴露服务交互。该问题已通过升级至9.0版本修复。...
2025-7-9 22:19:8 | 阅读: 18 |
收藏
|
Full Disclosure - seclists.org
korelogic
schneider
electric
dce
KL-001-2025-010: Schneider Electric EcoStruxure IT Data Center Expert Privilege Escalation
Schneider Electric EcoStruxure IT Data Center Expert 存在权限提升漏洞（CVE-2025-50124），影响8.3及以下版本。攻击者可利用Charon工具获取root权限。已发布9.0修复版本。...
2025-7-9 22:18:43 | 阅读: 39 |
收藏
|
Full Disclosure - seclists.org
attacker
python2
korelogic
xyzzy
nbc
KL-001-2025-009: Schneider Electric EcoStruxure IT Data Center Expert Remote Command Execution
Schneider Electric EcoStruxure IT Data Center Expert 8.3及以下版本存在远程代码注入漏洞，攻击者可通过恶意hostname执行root权限命令；已发布补丁升级至9.0修复。...
2025-7-9 22:17:54 | 阅读: 27 |
收藏
|
Full Disclosure - seclists.org
korelogic
electric
schneider
appliance
ecostruxure
KL-001-2025-008: Schneider Electric EcoStruxure IT Data Center Expert Root Password Discovery
施耐德电气EcoStruxure IT数据中心专家软件存在漏洞（CVE-2025-50122），攻击者可通过MAC地址和JAR文件计算root密码。该漏洞影响8.3及以下版本，在CentOS平台上运行。已发布9.0版本修复。...
2025-7-9 22:17:15 | 阅读: 23 |
收藏
|
Full Disclosure - seclists.org
korelogic
electric
schneider
appliance
normalized
KL-001-2025-007: Schneider Electric EcoStruxure IT Data Center Expert Unauthenticated Remote Code Execution
Schneider Electric EcoStruxure IT Data Center Expert 8.3及以下版本存在未认证远程代码执行漏洞（CVE-2025-50121），通过路径遍历和SSRF攻击可获取root权限。...
2025-7-9 22:16:27 | 阅读: 18 |
收藏
|
Full Disclosure - seclists.org
korelogic
nbc
netbotz
dce
schneider
KL-001-2025-006: Schneider Electric EcoStruxure IT Data Center Expert XML External Entities Injection
Schneider Electric EcoStruxure IT Data Center Expert 8.3及以下版本存在XML外部实体注入漏洞（CVE-2025-6438），允许攻击者读取本地文件、伪造请求或耗尽资源。已发布9.0修复版本。...
2025-7-9 22:15:52 | 阅读: 24 |
收藏
|
Full Disclosure - seclists.org
korelogic
electric
schneider
soapenv
99999
eSIM security research (GSMA eUICC compromise and certificate theft)
研究人员成功破解Kigen eUICC卡及其GSMA消费者证书，揭示eSIM配置文件与Java应用间缺乏安全隔离。此次攻击利用物理访问及密钥知识，在远程OTA协议下亦可实现恶意应用安装。研究证实2019年报告的Java Card漏洞真实存在，并对行业提出警示。...
2025-7-9 08:28:31 | 阅读: 27 |
收藏
|
Full Disclosure - seclists.org
security
esim
euicc
kigen
Directory Traversal "Site Title" - bluditv3.16.2
该漏洞存在于Bludit CMS 3.16.2版本中，允许通过篡改"Site Title"字段实现目录遍历，并上传恶意SVG文件至任意路径。...
2025-7-8 02:50:55 | 阅读: 24 |
收藏
|
Full Disclosure - seclists.org
bludit
malicious
perl
sat
php
XSS via SVG File Uploa - bluditv3.16.2
Bludit v3.16.2 存在 XSS 漏洞，允许攻击者通过上传包含恶意脚本的 SVG 文件触发跨站脚本攻击。该漏洞影响 Debian 12 环境下的系统。...
2025-7-8 02:50:52 | 阅读: 22 |
收藏
|
Full Disclosure - seclists.org
stoykov
bludit
andrey
graphics
Stored XSS "Add New Content" Functionality - bluditv3.16.2
文章描述了一个针对Bludit CMS 3.16.2版本的Stored XSS漏洞。攻击者可通过管理员账户在"Add New Content"功能中输入恶意代码触发XSS攻击。具体步骤包括在"Source Code"字段中插入特定payload，并通过预览触发弹窗警告。该漏洞可能允许攻击者执行跨站脚本攻击。...
2025-7-8 02:50:50 | 阅读: 22 |
收藏
|
Full Disclosure - seclists.org
bludit
perl
textarea
stoykov
andrey
Session Fixation - bluditv3.16.2
Bludit v3.16.2 存在会话固定漏洞，攻击者可利用该漏洞劫持用户会话。具体表现为用户登录后会话ID未更新，导致攻击者可预测或控制会话标识符。该漏洞已在Debian 12环境中复现。建议用户及时更新至最新版本以修复此问题。...
2025-7-8 02:50:48 | 阅读: 21 |
收藏
|
Full Disclosure - seclists.org
bludit
stoykov
fixation
andrey
bluditv3
CVE-2025-38089：Linux内核NFS服务器通过NULL指针解引用导致远程拒绝服务漏洞分析
Linux内核SUNRPC子系统存在漏洞CVE-2025-38089，允许远程攻击者通过特制的RPC请求引发内核崩溃（空指针解引用），影响NFS服务器版本自特定提交以来至修复前版本。已修复并公开。...
2025-7-2 13:7:0 | 阅读: 17 |
收藏
|
玄武实验室每日安全 - seclists.org
nfs
remote
crash
dereference
38089
iOS Activation Flaw Enables Pre-User Device Compromise and Identity Exposure (iOS 18.5)
苹果iOS 18.5版本存在激活漏洞，攻击者可在用户首次使用前通过网络注入恶意XML配置文件，导致设备信任链和网络行为被操控，影响隐私和安全。该漏洞未被苹果修复，已报告至US-CERT，并引发GDPR等隐私法规风险。...
2025-7-1 06:49:54 | 阅读: 20 |
收藏
|
Full Disclosure - seclists.org
activation
payload
Remote DoS in httpx 1.7.0 – Out-of-Bounds Read via Malformed
Tag</a> <span class="d-block small opacity-50"> ProjectDiscovery的httpx v1.7.0存在远程DoS漏洞，通过返回畸形<title>标签可触发崩溃。问题源于trimTitleTags函数中缺少边界检查导致切片越界。此漏洞影响自动化扫描工具，修复已提交。...<br> 2025-6-26 04:37:53 | 阅读: 122 | <a onclick='addCollect("345023")' style='font-size:13px' href="#">收藏</a> | <a href="?domain=seclists.org"> <img style="width: 16px;" src="/image?f=https%3A%2F%2Ft0.gstatic.com%2FfaviconV2%3Fclient%3DSOCIAL%26type%3DFAVICON%26fallback_opts%3DTYPE%2CSIZE%2CURL%26url%3Dhttp%3A%2F%2Fseclists.org%26size%3D128" onerror="this.src=getIcon('seclists.org','https:\/\/seclists.org\/fulldisclosure\/2025\/Jun\/26')" class="rounded float-left" alt="..."> Full Disclosure - seclists.org </a> <br> <span class="badge bg-secondary">httpx</span> <span class="badge bg-secondary">titlebegin</span> <span class="badge bg-secondary">malformed</span> <span class="badge bg-secondary">titleend</span> <br> </span> </label> </td> </tr> </table> <table style="margin-top: 20px;"> <tr> <td class="" style="height: 150px;width: 30%;border: none;"> <img class="banner_img" id="banner_img" src="" onerror="this.src=randomImage('https:\/\/seclists.org\/fulldisclosure\/2025\/Jun\/25')"> </td> <td class="list-group-item py-3" style="min-height: 152px;border: none;"> <label> <a class="paper_list" href="/go-344416.html">CVE-2025-32978 - Quest KACE SMA Unauthenticated License Replacement</a> <span class="d-block small opacity-50"> Quest KACE SMA 存在高危漏洞，允许未认证用户通过 Web 接口替换系统许可证，导致拒绝服务。该漏洞 CVSS 评分为 7.5 分，已修复版本包括 13.0.385 等。...<br> 2025-6-24 03:13:31 | 阅读: 96 | <a onclick='addCollect("344416")' style='font-size:13px' href="#">收藏</a> | <a href="?domain=seclists.org"> <img style="width: 16px;" src="/image?f=https%3A%2F%2Ft0.gstatic.com%2FfaviconV2%3Fclient%3DSOCIAL%26type%3DFAVICON%26fallback_opts%3DTYPE%2CSIZE%2CURL%26url%3Dhttp%3A%2F%2Fseclists.org%26size%3D128" onerror="this.src=getIcon('seclists.org','https:\/\/seclists.org\/fulldisclosure\/2025\/Jun\/25')" class="rounded float-left" alt="..."> Full Disclosure - seclists.org </a> <br> <span class="badge bg-secondary">seralys</span> <span class="badge bg-secondary">quest</span> <span class="badge bg-secondary">kace</span> <span class="badge bg-secondary">sma</span> <br> </span> </label> </td> </tr> </table> <table style="margin-top: 20px;"> <tr> <td class="" style="height: 150px;width: 30%;border: none;"> <img class="banner_img" id="banner_img" src="" onerror="this.src=randomImage('https:\/\/seclists.org\/fulldisclosure\/2025\/Jun\/24')"> </td> <td class="list-group-item py-3" style="min-height: 152px;border: none;"> <label> <a class="paper_list" href="/go-344417.html">CVE-2025-32977 - Quest KACE Unauthenticated Backup Upload</a> <span class="d-block small opacity-50"> Quest KACE SMA存在未认证备份上传漏洞（CVE-2025-32977），允许攻击者上传恶意备份文件，导致系统受损。该漏洞已修复于多个版本中。...<br> 2025-6-24 03:13:29 | 阅读: 42 | <a onclick='addCollect("344417")' style='font-size:13px' href="#">收藏</a> | <a href="?domain=seclists.org"> <img style="width: 16px;" src="/image?f=https%3A%2F%2Ft0.gstatic.com%2FfaviconV2%3Fclient%3DSOCIAL%26type%3DFAVICON%26fallback_opts%3DTYPE%2CSIZE%2CURL%26url%3Dhttp%3A%2F%2Fseclists.org%26size%3D128" onerror="this.src=getIcon('seclists.org','https:\/\/seclists.org\/fulldisclosure\/2025\/Jun\/24')" class="rounded float-left" alt="..."> Full Disclosure - seclists.org </a> <br> <span class="badge bg-secondary">seralys</span> <span class="badge bg-secondary">quest</span> <span class="badge bg-secondary">backup</span> <span class="badge bg-secondary">kace</span> <br> </span> </label> </td> </tr> </table> </div> <br> <nav class="d-flex justify-content-center" aria-label="Page navigation example"> <ul class="pagination pagination-sm"> <li class="page-item"><a class="page-link" href="/?page=14&domain=seclists.org">Previous</a></li> <li class="page-item"><a class="page-link" href="/?page=15&domain=seclists.org">15</a></li> <li class="page-item"><a class="page-link" href="/?page=16&domain=seclists.org">16</a></li> <li class="page-item"><a class="page-link" href="/?page=17&domain=seclists.org">17</a></li> <li class="page-item"><a class="page-link" href="/?page=18&domain=seclists.org">18</a></li> <li class="page-item"><a class="page-link" href="/?page=19&domain=seclists.org">19</a></li> <li class="page-item"><a class="page-link" href="/?page=20&domain=seclists.org">20</a></li> <li class="page-item"><a class="page-link" href="/?page=21&domain=seclists.org">21</a></li> <li class="page-item"><a class="page-link" href="/?page=22&domain=seclists.org">22</a></li> <li class="page-item"><a class="page-link" href="/?page=16&domain=seclists.org">Next</a></li> </ul> </nav> </div> <script> function addCollect(id) { $.get("/user/addcollect?id=" + id, function(data) { alert(data); }) } </script> <svg xmlns="http://www.w3.org/2000/svg" style="display: none;"> <symbol id="facebook" viewBox="0 0 16 16"> <path d="M16 8.049c0-4.446-3.582-8.05-8-8.05C3.58 0-.002 3.603-.002 8.05c0 4.017 2.926 7.347 6.75 7.951v-5.625h-2.03V8.05H6.75V6.275c0-2.017 1.195-3.131 3.022-3.131.876 0 1.791.157 1.791.157v1.98h-1.009c-.993 0-1.303.621-1.303 1.258v1.51h2.218l-.354 2.326H9.25V16c3.824-.604 6.75-3.934 6.75-7.951z"/> </symbol> <symbol id="instagram" viewBox="0 0 16 16"> <path d="M8 0C5.829 0 5.556.01 4.703.048 3.85.088 3.269.222 2.76.42a3.917 3.917 0 0 0-1.417.923A3.927 3.927 0 0 0 .42 2.76C.222 3.268.087 3.85.048 4.7.01 5.555 0 5.827 0 8.001c0 2.172.01 2.444.048 3.297.04.852.174 1.433.372 1.942.205.526.478.972.923 1.417.444.445.89.719 1.416.923.51.198 1.09.333 1.942.372C5.555 15.99 5.827 16 8 16s2.444-.01 3.298-.048c.851-.04 1.434-.174 1.943-.372a3.916 3.916 0 0 0 1.416-.923c.445-.445.718-.891.923-1.417.197-.509.332-1.09.372-1.942C15.99 10.445 16 10.173 16 8s-.01-2.445-.048-3.299c-.04-.851-.175-1.433-.372-1.941a3.926 3.926 0 0 0-.923-1.417A3.911 3.911 0 0 0 13.24.42c-.51-.198-1.092-.333-1.943-.372C10.443.01 10.172 0 7.998 0h.003zm-.717 1.442h.718c2.136 0 2.389.007 3.232.046.78.035 1.204.166 1.486.275.373.145.64.319.92.599.28.28.453.546.598.92.11.281.24.705.275 1.485.039.843.047 1.096.047 3.231s-.008 2.389-.047 3.232c-.035.78-.166 1.203-.275 1.485a2.47 2.47 0 0 1-.599.919c-.28.28-.546.453-.92.598-.28.11-.704.24-1.485.276-.843.038-1.096.047-3.232.047s-2.39-.009-3.233-.047c-.78-.036-1.203-.166-1.485-.276a2.478 2.478 0 0 1-.92-.598 2.48 2.48 0 0 1-.6-.92c-.109-.281-.24-.705-.275-1.485-.038-.843-.046-1.096-.046-3.233 0-2.136.008-2.388.046-3.231.036-.78.166-1.204.276-1.486.145-.373.319-.64.599-.92.28-.28.546-.453.92-.598.282-.11.705-.24 1.485-.276.738-.034 1.024-.044 2.515-.045v.002zm4.988 1.328a.96.96 0 1 0 0 1.92.96.96 0 0 0 0-1.92zm-4.27 1.122a4.109 4.109 0 1 0 0 8.217 4.109 4.109 0 0 0 0-8.217zm0 1.441a2.667 2.667 0 1 1 0 5.334 2.667 2.667 0 0 1 0-5.334z"/> </symbol> <symbol id="twitter" viewBox="0 0 16 16"> <path d="M5.026 15c6.038 0 9.341-5.003 9.341-9.334 0-.14 0-.282-.006-.422A6.685 6.685 0 0 0 16 3.542a6.658 6.658 0 0 1-1.889.518 3.301 3.301 0 0 0 1.447-1.817 6.533 6.533 0 0 1-2.087.793A3.286 3.286 0 0 0 7.875 6.03a9.325 9.325 0 0 1-6.767-3.429 3.289 3.289 0 0 0 1.018 4.382A3.323 3.323 0 0 1 .64 6.575v.045a3.288 3.288 0 0 0 2.632 3.218 3.203 3.203 0 0 1-.865.115 3.23 3.23 0 0 1-.614-.057 3.283 3.283 0 0 0 3.067 2.277A6.588 6.588 0 0 1 .78 13.58a6.32 6.32 0 0 1-.78-.045A9.344 9.344 0 0 0 5.026 15z"/> </symbol> </svg> <footer class="d-flex flex-wrap justify-content-between align-items-center py-3 my-4 border-top"> <div class="col-md-4 d-flex align-items-center"> <a href="/" class="mb-3 me-2 mb-md-0 text-muted text-decoration-none lh-1"> </a> <p class="mt-5 mb-3 text-muted">© <a href="https://unsafe.sh">unSafe.sh - 不安全</a> Powered By <a href="https://github.com/code-scan/PaperCache">PaperCache</a></p> </div> <ul style="padding: 20px" class="nav col-md-4 justify-content-end list-unstyled d-flex"> <li class="ms-3"><a href="#">admin#unsafe.sh</a></li> <li class="ms-3"><a href="https://aq.mk">安全马克</a></li> <li class="ms-3"><a href="https://xj.hk">星际黑客</a></li> <li class="ms-3"><a href="https://t00ls.net">T00ls</a></li> </ul> </footer> </body> <script charset="UTF-8" id="LA_COLLECT" src="//sdk.51.la/js-sdk-pro.min.js"></script> <script>LA.init({id:"KiRUVDOwqCVHgDgf",ck:"KiRUVDOwqCVHgDgf"})</script> </html>