PatchaPalooza

PatchaPalooza patchapalooza.com — 互动版已上线！ 本CLI工具已被 patchapalooza.com 取代，这是一个用于探索和分析微软补丁星期二（Patch Tuesday）数据的完整互动网站。它涵盖此工具的所有功能，甚至更多。请访问该网站以获得最佳体验。 此仓库仍作为轻量级CLI替代方案可用，但不再积极维护。 描述 PatchaPalooza 利用微软 MSRC CVRF API...

New-lib3mf.dll-for-MeshMixer

适用于 MeshMixer 的新版 lib3mf.dll 为 MeshMixer 预编译的 lib3mf.dll，包含针对 CVE-2021-21772 的回移植补丁以及更新的 zlib 1.3.1。 替换原始文件到 C:\Program Files\Autodesk\Meshmixer\ 包含源代码，如果您希望自行编译。 CVE-2021-21772：https://talosintelligence.com/vulnerabilityreports/TALOS-2020-1226...

legacy-rails-CVE-2020-5267-patch

legacy-rails-CVE-2020-5267-patch 针对 Rails 4 和 Rails 3 的 CVE-2020-5267 补丁。升级 Rails 肯定是更好的选择，但如果你暂时仍停留在旧版本的 Rails 上，该 gem 提供了安全公告中提到的猴子补丁，并已打包和测试。 安装 将以下行添加到应用程序的 Gemfile 中： root@kitploit: gem 'legacy-rails-CVE-2020-5267-patch' 然后执行： root@kitploit: $ bundle install...

CVE-2018-12598

CVE-2018-12598 CVE-2018-12598 时间线 ================ 2018-06-08: 发现 2018-06-11: 重新测试暂存环境 2018-06-12: 重新测试线上环境 2018-06-19: 内部沟通 2018-06-21: 通知供应商 2018-06-XX: 供应商反馈 2018-06-XX: 供应商反馈产品将得到修补 2018-06-XX: 补丁可用 2018-06-XX: 与供应商达成协议，发布 CVE/公告。 2018-06-XX: 公开报告 作者 Alex Hernandez 又名 @alt3kx...

dnsmasq-2.4.1-fix-CVE-2017-14491

dnsmasq-2.4.1-fix-CVE-2017-14491...

CVE-2022-30190-Follina-Patch

CVE-2022-30190-Follina-Patch 这是一个简单的程序，允许您一次性完成临时补丁的工作区，而无需在cmd中键入（针对特定人群）。 需要以管理员身份运行。 6/2/2022 图片 可执行文件 手动 以管理员身份运行命令提示符。 要备份注册表项，请执行命令 reg export HKEYCLASSESROOT\ms-msdt filename 执行命令 reg delete HKEYCLASSESROOT\ms-msdt /f。...

smbexec

root@kitploit: smbexec A rapid psexec style attack with samba tools Original Concept and Script by Brav0Hax & PureHate Ported to ruby and modified by Smilingraccoon and Zeknox Codename - Machiavellian Written because we got sick of Metasploit PSExec getting popped Special thanks to Carnal0wnage...

Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution

Spring Data REST 2.6.9 and 3.0.1, Spring Boot 1.5.9 and 2.0 M6 contain a remote code execution caused by processing malicious PATCH requests with crafted JSON data, letting attackers execute arbitrary Java code, exploit requires sending malicious PATCH requests. id: CVE-2017-8046 info: name: Spri...

HPE System Management - Cross-Site Scripting

HPE System Management contains a cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other...

WordPress Integrator 1.32 - Cross-Site Scripting

A cross-site scripting vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirectto parameter to wp-login.php. id: CVE-2012-5913 info: name: WordPress Integrator 1.32 - Cross-Site Scripti...

XWiki - Cross-Site Scripting

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the restore template to perform a XSS, e.g. by using URL such as:...

PMB v7.4.6 - Cross-Site Scripting

PMB v7.4.6 allows an attacker to perform a reflected XSS on exportz3950.php via the 'query' parameter. id: CVE-2023-24737 info: name: PMB v7.4.6 - Cross-Site Scripting author: r3Y3r53 severity: medium description: | PMB v7.4.6 allows an attacker to perform a reflected XSS on exportz3950.php via t...

Commvault CommCell - Local File Inclusion

CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13 are vulnerable to local file inclusion because an attacker can view a log file can instead view a file outside of the log-files folder. id: CVE-2020-25780 info: name: Commvault...

74cms - ajax_officebuilding.php SQL Injection

A SQL injection vulnerability exists in 74cms 3.2.0 via the x parameter to ajaxofficebuilding.php. id: CVE-2020-22210 info: name: 74cms - ajaxofficebuilding.php SQL Injection author: ritikchaddha severity: critical description: | A SQL injection vulnerability exists in 74cms 3.2.0 via the x...

Agentejo Cockpit 0.10.2 - Cross-Site Scripting

Agentejo Cockpit 0.10.2 contains a reflected cross-site scripting vulnerability due to insufficient sanitization of the to parameter in the /auth/login route, which allows for injection of arbitrary JavaScript code into a web page's content. id: CVE-2020-14408 info: name: Agentejo Cockpit 0.10.2 ...

Eaton Intelligent Power Manager 1.6 - Directory Traversal

Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via directory traversal, which can lead to sensitive information disclosure, denial of service and code execution. id: CVE-2018-12031 info: name: Eaton Intelligent Power Manager 1.6 - Directory Traversal author: daffainfo...

Navidrome <=0.54.5 - Authentication Bypass in Subsonic API

Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system,...

Autonomy Ultraseek - Open Redirect

Open redirect vulnerability in cs.html in the Autonomy formerly Verity Ultraseek search engine allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter. id: CVE-2009-0347 info: name: Autonomy Ultraseek - Open Redirect author: ctflearner...

Cisco ISE < 3.4P2 - Unauthenticated Arbitrary File Upload

Cisco ISE and Cisco ISE-PIC contain an unrestricted file upload vulnerability caused by lack of file validation in an internal API, letting unauthenticated remote attackers upload and execute files as root, exploit requires crafted file upload. id: CVE-2025-20282 info: name: Cisco ISE 3.4P2 -...

DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 contains a cross-site scripting vulnerability via assets/add/account-owner.php Owner name field. id: CVE-2018-19749 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 contains a cross-site scripting...