BestHub
Sign in
Tag

vulnerability

2 views collected around this technical thread.

Instant Consumer Technology Team
Instant Consumer Technology Team
May 13, 2025 · Information Security

Uncovering Critical Security Flaws in Model Context Protocol (MCP) Servers

This article provides a systematic security analysis of the Model Context Protocol (MCP), demonstrating how malicious tool definitions, prompt injection, command injection, and over‑privileged implementations enable data theft, arbitrary code execution, and large‑scale attacks against AI agents and their users.

AIInformation SecurityMCP
0 likes · 33 min read
Uncovering Critical Security Flaws in Model Context Protocol (MCP) Servers
Java Tech Enthusiast
Java Tech Enthusiast
Sep 4, 2024 · Information Security

Spring and Nacos Security Vulnerabilities and Mitigation Guide

Recent disclosures revealed critical Spring DoS flaws (CVE‑2024‑38809 and CVE‑2024‑38808) exploitable via oversized If‑Match/If‑None‑Match headers and malicious SpEL expressions, plus a Nacos 2.4.1 vulnerability allowing arbitrary file read/write through port 7848, mitigated by upgrading to the patched Spring and Nacos releases or restricting the vulnerable ports.

CVEJavaNacos
0 likes · 7 min read
Spring and Nacos Security Vulnerabilities and Mitigation Guide
IT Services Circle
IT Services Circle
Aug 12, 2024 · Information Security

The 'Indler' Linux Kernel Vulnerability: A 0‑Day Exploit Discovered After 12 Years

A newly disclosed Linux kernel vulnerability called "indler"—a 0‑day memory‑corruption bug hidden since 2012—was uncovered by security researcher Zhang Yinkui, who detailed its discovery via a random kernel oops, KASAN detection, and its potential for massive remote code execution across billions of devices.

0-DayKASANKernel
0 likes · 9 min read
The 'Indler' Linux Kernel Vulnerability: A 0‑Day Exploit Discovered After 12 Years
Java Tech Enthusiast
Java Tech Enthusiast
Jun 1, 2024 · Information Security

Git CVE-2024-32002 Remote Code Execution Vulnerability Analysis

The article examines Git CVE‑2024‑32002, a remote‑code‑execution flaw that lets attackers run malicious code simply by cloning a crafted repository, exploiting Git hooks, submodules and case‑insensitive symbolic‑link tricks, and advises users to verify their Git version and update to mitigate the risk.

CVE-2024-32002HooksRCE
0 likes · 9 min read
Git CVE-2024-32002 Remote Code Execution Vulnerability Analysis
Sohu Tech Products
Sohu Tech Products
Dec 20, 2023 · Information Security

Command Injection Vulnerabilities in Node.js: Analysis and Prevention

The article examines how command‑injection flaws in popular Node.js npm packages such as find‑exec and fs‑git arise from unsafe concatenation of user input into shell commands, and recommends rigorous validation, using execFile or spawn, and regular dependency audits to prevent catastrophic system compromise.

CVESecure Codingchild_process
0 likes · 11 min read
Command Injection Vulnerabilities in Node.js: Analysis and Prevention
Laravel Tech Community
Laravel Tech Community
Oct 29, 2023 · Information Security

Remote Code Execution Vulnerability in Apache ActiveMQ < 5.18.3 (Deserialization)

Apache ActiveMQ versions prior to 5.18.3 are vulnerable to a deserialization flaw that allows remote code execution via crafted OpenWire messages on port 61616, affecting various activemq-client and activemq-openwire-legacy artifacts, and can be mitigated by upgrading to 5.15.16, 5.16.7, 5.17.6, 5.18.3 or later.

Apache ActiveMQInformation SecurityMessaging Middleware
0 likes · 3 min read
Remote Code Execution Vulnerability in Apache ActiveMQ < 5.18.3 (Deserialization)
IT Services Circle
IT Services Circle
Oct 18, 2023 · Information Security

Critical libcurl Vulnerabilities (CVE-2023-38545 & CVE-2023-38546) and Upcoming curl 8.4.0 Patch

The article reports two high‑severity libcurl vulnerabilities (CVE‑2023‑38545 and CVE‑2023‑38546) disclosed by curl’s maintainer, explains the limited public information before the scheduled curl 8.4.0 release, and urges developers to upgrade promptly due to the library’s widespread use.

CVE-2023-38545CVE-2023-38546Patch
0 likes · 5 min read
Critical libcurl Vulnerabilities (CVE-2023-38545 & CVE-2023-38546) and Upcoming curl 8.4.0 Patch
IT Services Circle
IT Services Circle
Sep 8, 2023 · Information Security

High‑Severity Vulnerabilities Discovered in Notepad++ (CVE‑2023‑40031, CVE‑2023‑40036, CVE‑2023‑40164, CVE‑2023‑40166)

Security researchers have identified four high‑severity buffer‑overflow vulnerabilities (CVE‑2023‑40031, CVE‑2023‑40036, CVE‑2023‑40164, CVE‑2023‑40166) in the popular open‑source editor Notepad++, disclosed after the developers failed to patch them before the release of version 8.5.6, urging users to apply mitigations.

CVEInformation SecurityNotepad
0 likes · 3 min read
High‑Severity Vulnerabilities Discovered in Notepad++ (CVE‑2023‑40031, CVE‑2023‑40036, CVE‑2023‑40164, CVE‑2023‑40166)
Laravel Tech Community
Laravel Tech Community
Aug 8, 2023 · Information Security

OpenSSH ssh-agent Client Remote Code Execution Vulnerability (CVE-2023-38408)

A critical OpenSSH ssh-agent vulnerability (CVE-2023-38408) allows attackers to execute arbitrary code on the client by forwarding the agent and loading a malicious shared library, affecting all ssh-agent versions up to 9.3p2 and OpenSSH versions up to 9.3p2‑1, with mitigation recommendations to disable forwarding and upgrade the package.

CVE-2023-38408Information SecurityOpenSSH
0 likes · 3 min read
OpenSSH ssh-agent Client Remote Code Execution Vulnerability (CVE-2023-38408)
AntTech
AntTech
Jun 26, 2023 · Blockchain

Detailed Analysis of the Tornado Cash Governance Attack and Smart‑Contract Exploitation

This article examines the multi‑stage Tornado Cash governance attack, explaining the proposal mechanism, token‑locking logic, creation of zombie accounts, use of create/create2, malicious self‑destruct functions, delegatecall exploitation, and the resulting token theft, while highlighting key security lessons for blockchain governance.

BlockchainSecurityDeFiEthereum
0 likes · 17 min read
Detailed Analysis of the Tornado Cash Governance Attack and Smart‑Contract Exploitation
Java Architecture Diary
Java Architecture Diary
Mar 22, 2023 · Information Security

Understanding Spring Framework DoS Vulnerability CVE-2023-20861 and How to Fix It

This article explains the Spring Framework DoS vulnerability (CVE‑2023‑20861), outlines affected versions, details the root cause in SpEL expression handling, and provides step‑by‑step mitigation and upgrade instructions for both Spring Framework and Spring Boot, along with references and security considerations.

CVE-2023-20861DoSMitigation
0 likes · 7 min read
Understanding Spring Framework DoS Vulnerability CVE-2023-20861 and How to Fix It
Laravel Tech Community
Laravel Tech Community
Mar 13, 2023 · Information Security

PHP password_verify() Validation Error Vulnerability (CVE-2023-0567)

The PHP password_verify() function suffers a validation error vulnerability in certain versions where a "$" character in the BCrypt salt triggers a buffer over‑read, allowing any password to be accepted as valid and potentially enabling password‑less logins.

Information SecurityPHPPatch
0 likes · 2 min read
PHP password_verify() Validation Error Vulnerability (CVE-2023-0567)
vivo Internet Technology
vivo Internet Technology
Mar 8, 2023 · Information Security

Web Cache Poisoning and HTTP Request Smuggling: Principles, Attack Scenarios, and Defenses

The article explains how misconfigured caches and inconsistent front‑end/back‑end parsing enable web cache poisoning and HTTP request smuggling attacks, illustrates practical exploitation scenarios, and recommends disabling caching, unifying request‑boundary logic, and adopting HTTP/2 or strict configurations to defend against these high‑impact threats.

Cache PoisoningDefense StrategiesHTTP Request Smuggling
0 likes · 16 min read
Web Cache Poisoning and HTTP Request Smuggling: Principles, Attack Scenarios, and Defenses
Laravel Tech Community
Laravel Tech Community
Mar 6, 2023 · Information Security

GitLab Stored XSS Vulnerability (CVE-2023-0050) – Description, Impact, and Fixes

A stored XSS vulnerability (CVE-2023-0050) in affected GitLab CE/EE versions allows attackers to execute arbitrary JavaScript via crafted Kroki diagrams, with a broad impact and remediation requiring upgrades to version 15.7.8 or later.

CVE-2023-0050GitLabInformation Security
0 likes · 3 min read
GitLab Stored XSS Vulnerability (CVE-2023-0050) – Description, Impact, and Fixes
Laravel Tech Community
Laravel Tech Community
Feb 15, 2023 · Information Security

ThinkPHP Deserialization Vulnerability (CVE-2022-45982)

The ThinkPHP framework suffers from a deserialization vulnerability (CVE‑2022‑45982) affecting versions 6.0.0‑6.0.13 and 6.1.0‑6.1.1, where unsanitized user input passed to unserialize() can allow attackers to execute arbitrary system commands, and no official patch has been released yet.

CVE-2022-45982PHPThinkPHP
0 likes · 2 min read
ThinkPHP Deserialization Vulnerability (CVE-2022-45982)
Laravel Tech Community
Laravel Tech Community
Dec 29, 2022 · Information Security

Security Vulnerability Analysis of XiongHai CMS 1.0

The article provides a detailed security analysis of the XiongHai CMS 1.0, describing its directory structure and exposing multiple vulnerabilities including file inclusion, SQL injection, XSS, and vertical privilege escalation, along with example exploit code.

CMSFile InclusionSQL injection
0 likes · 8 min read
Security Vulnerability Analysis of XiongHai CMS 1.0
Laravel Tech Community
Laravel Tech Community
Nov 24, 2022 · Information Security

Comprehensive phpMyAdmin Vulnerability Exploitation Guide

This article provides an extensive overview of phpMyAdmin security weaknesses, detailing information‑gathering techniques, version detection, path discovery, multiple exploitation methods such as file writes, log manipulation, slow‑query abuse, user‑defined functions, MOF attacks, and step‑by‑step PoCs for numerous CVEs, all illustrated with concrete SQL and script examples.

CVESQL injectionexploitation
0 likes · 19 min read
Comprehensive phpMyAdmin Vulnerability Exploitation Guide
Code Ape Tech Column
Code Ape Tech Column
Nov 14, 2022 · Information Security

Nacos Permission Bypass Vulnerability and Its Fix

This article explains a permission‑bypass vulnerability in Nacos 1.4.2 caused by a specific User‑Agent header, demonstrates how to reproduce it, and provides step‑by‑step instructions for fixing the issue by upgrading to version 2.1.1 or adjusting configuration files.

NacosPermission Bypassconfiguration
0 likes · 6 min read
Nacos Permission Bypass Vulnerability and Its Fix