rust-reversing-workshop-recon-2024

Reversing Rust Binaries: One step beyond strings - REcon 2024 Workshop This repository contains the supplementary files for the Reversing Rust Binaries: One step beyond strings workshop at REcon 2024, presented on June 28, 2024. During the presentation, we will be building and reversing a very...

CVE-Vulnerability-Information-Downloader

CVE Vulnerability Information Downloader Common Vulnerability Scoring System CVSS is a free and open industry standard for assessing the severity of computer system security vulnerabilities. Exploit Prediction Scoring System EPSS estimates the likelihood that a software vulnerability will be...

twint-utils

twint-utils These are utilizations of Twint. Please check out our collaboration guidelines to contribute to these. Mutuals Detector Mufos.py uses Twint to detect a given seed accounts mutual followers. It can be incorporated into other more elaborate pipelines for social networks or millieu...

krustyloader-analysis

KrustyLoader Analysis This repository contains resources related to the analysis made on KrustyLoader and available on this blog post: https://www.synacktiv.com/publications/krustyloader-rust-malware-linked-to-ivanti-connectsecure-compromises. a Python script to extract and decrypt URL used by th...

cracked

Cracked Download and train your retro-engineering skills 🖳 What is Cracked? Cracked is a TUI for downloading quickly crackmes.one challenges while staying in your terminal. How to use Cracked? Installation cargo install cracked Usage $ cracked --help Usage: cracked OPTIONS Options: -n, --name...

snapchat-map-scraper

Snapchat Story Downloader This program can search Snapchat's public Snap Map at multiple locations and download all stories for later investigation and categorization. A lot is unknown about how Snapchat decides which videos show up at which "point" on the map, so the scraper can also randomize t...

WordPress MDC YouTube Downloader 2.1.0 - Local File Inclusion

WordPress MDC YouTube Downloader 2.1.0 plugin is susceptible to local file inclusion. A remote attacker can read arbitrary files via a full pathname in the file parameter to includes/download.php. id: CVE-2015-5469 info: name: WordPress MDC YouTube Downloader 2.1.0 - Local File Inclusion author:...

SolarView Compact < 6.00 - Directory Traversal

SolarView Compact before version 6.00 is vulnerable to directory traversal via the file parameter in downloader.php. An unauthenticated attacker can read arbitrary files from the system by using path traversal sequences with a null byte bypass to access sensitive files such as /etc/passwd. id:...

CVE-2026-60018

Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a timeout. An authenticated user who can start a repository migration can direct it to an attacker-controlled OneDev-compatible server returning an oversized or...

EUVD-2026-101284

Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a timeout. An authenticated user who can start a repository migration can direct it to an attacker-controlled OneDev-compatible server returning an oversized or...

CVE-2019-14751_PoC

CVE-2019-14751PoC A Proof of Concept for CVE-2019-14751 Vulnerability Description NLTK Downloader before version 3.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ dot dot slash in an NLTK package ZIP archive that is mishandled during extraction. For...

BlackLotus-Z2A-Challenge

BlackLotus-Z2A-Challenge BlackLotus-Z2A-Challenge, Nothing to see here 4 now , please move along First things first For aesthetic purposes soley, I will shamesly borrowsteal : from @darthmaulwareRyan “DM” Smith solution the yara detection rules just to make it look proffesional. Go check his...

CVE-2026-60018

The OneDev migration downloader reads the entire "/api/version/server" response body into memory before validating the version string, and the migration HTTP client has no timeout. A malicious OneDev-compatible server can return a very large or never-ending response...

CVE-2026-60021

The GitLab migration downloader probes the remote "/api/v4/version" endpoint using an HTTP client with no timeout, and issues that request without the migration task context. A malicious GitLab-compatible server can keep the response open indefinitely; because the request is not bound to the task...

instaloader

.. image:: https://raw.githubusercontent.com/instaloader/instaloader/master/docs/logoheading.png .. badges-start |pypi| |pyversion| |license| |aur| |contributors| |downloads| .. |pypi| image:: https://img.shields.io/pypi/v/instaloader.svg :alt: Pagina del Progetto Instaloader su PyPI :target:...

CVE-2026-103648

CVE-2026-103648 — Path Traversal in image-downloader Discovered by:Amirhossein Roustaei @EterNullSec — Eternull Security 📖 Full technical writeup:eternull.net/posts/cve-2026-103648-image-downloader-path-traversal ⚠️ Educational Purposes Only. This repository documents a responsibly disclosed...

CVE-2026-108580

AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI /login POST handler that allows unauthenticated attackers to guess passwords without throttling. Attackers can enumerate usernames through verifyuser response timing and...

EUVD-2026-96363

AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI /login POST handler that allows unauthenticated attackers to guess passwords without throttling. Attackers can enumerate usernames through verifyuser response timing and...

CVE-2026-108580

Versions of AniWorld Downloader prior to 5.3.0 are vulnerable to a WebUI login brute-force attack due to an improper restriction of authentication attempts in the /login POST handler. This flaw allows unauthenticated attackers to perform password guessing without any throttling. Additionally, att...

CVE-2026-108580 AniWorld Downloader before 5.3.0 WebUI Login Brute Force via /login

AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI /login POST handler that allows unauthenticated attackers to guess passwords without throttling. Attackers can enumerate usernames through verifyuser response timing and...