slopShell - The Only Php Webshell You Need

php webshell Since I derped, and forgot to talk about usage. Here goes. For this shell to work, you need 2 things, a victim that allows php file uploadyourself, in an educational environment and a way to send http requests to this webshell. Basic Usage VideoHosted on Youtube: Current VT Detection...

Exploit for SQL Injection in Cacti

CVE-2020-14295 CVE-2020-14295 proof of concept. The original p...

MGASA-2021-0222 Updated wireshark packages fix a security vulnerability

The MS-WSP dissector could consume excessive amounts of memory CVE-2021-22207...

FireStorePwn - Firestore Database Vulnerability Scanner Using APKs

fsp scans an APK and checks the Firestore database for rules that are not secure, testing with or without authentication. If there are problems with the security rules, attackers could steal, modify or delete data and raise the bill. Install fsp sudo wget...

PT-2021-18745 · Podofo +4 · Podofo +4

Name of the Vulnerable Software and Affected Versions: PoDoFo version 0.9.7 Description: A flaw was found in the PdfNamesTree::AddToDictionary function in src/podofo/doc/PdfNamesTree.cpp, which can lead to a stack overflow due to an uncontrolled recursive call. Recommendations: For PoDoFo version...

[ASA-202105-19] matrix-synapse: denial of service

Arch Linux Security Advisory ASA-202105-19 ========================================== Severity: Medium Date : 2021-05-25 CVE-ID : CVE-2021-29471 Package : matrix-synapse Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1943 Summary ======= The package matrix-synapse...

p11-kit security, bug fix, and enhancement update

0.23.22-1 - Rebase to 0.23.22 to fix memory safety issues CVE-2020-29361, CVE-2020-29362, and CVE-2020-29363 - Preserve DTNEEDED information from the previous version, flagged by rpmdiff - Add xsltproc to BR 0.23.21-4 - Fix realloc usage on proxy cleanup 1894979 - Make 'trust anchor --store'...

Malicious Package

Overview string-easy-assistant is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview e39testing is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview e39test is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Improper Access Control in causefx/organizr

✍️ Description Google Maps API key without proper referer restrictions is found in your repo. It can be embeded to anyone's website and if the billing account is active, it will incur charges on your account. 🕵️‍♂️ Proof of Concept Visit the following link to verify that you can use the service...

Libwebp Uninitialized Variable Usage Vulnerability

Libwebp is a WebP image format encoding and decoding library . A security vulnerability exists in versions of Libwebp prior to 1.0.1. The vulnerability stems from the use of a single variable in the ReadSymbol function. An attacker could exploit the vulnerability to threaten data confidentiality...

The vulnerability of the libuv library for DNS-servers like Bind9, which allows a hacker to cause a service failure.

The vulnerability of the libuv library for DNS-servers like Bind9 is related to the insufficient use of the assert function. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Improper Access Control in teamultroid/ultroid

✍️ Description Google Maps API key without proper referer restrictions is found in your repo. It can be embeded to anyone's website and if the billing account is active, it will incur charges on your account. 🕵️‍♂️ Proof of Concept Visit this link to verify that you can use the service by visiting...

Improper Access Control in kenzo-404/lynx-userbot

✍️ Description Google Maps API key without proper referer restrictions is found in your repo. It can be embeded to anyone's website and if the billing account is active, it will incur charges on your account. 🕵️‍♂️ Proof of Concept Visit this link to verify that you can use the service by visiting...

RHEL 8 : httpd:2.4 (RHSA-2021:1809)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1809 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: modsessioncookie...

Denial of Service (DoS) in HashiCorp Consul

HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 1.6.3. Specific Go Packages Affected github.com/hashicorp/consul/agent/consul...

GHSA-23JV-V6QJ-3FHH Denial of Service (DoS) in HashiCorp Consul

HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 1.6.3. Specific Go Packages Affected github.com/hashicorp/consul/agent/consul...

golang: cmd/go: packages using cgo can cause arbitrary code execution at build time

A flaw was found in golang: cmd/go, in which Go can execute arbitrary commands at build time when cgo is in use on Windows OS. On Linux/Unix, only users who have "." listed explicitly in their PATH variable are affected. The highest threat from this vulnerability is to data confidentiality and...

ALBA-2021:1807 gcc-toolset-10-dyninst bug fix and enhancement update

GCC Toolset is a compiler toolset that provides recent versions of development tools. GCC Toolset is an Application Stream packaged as a Software Collection. For instructions on usage, see Using GCC Toolset linked from the References section. Components and specifics of this version are documente...