CVE-2023-28432

CVE-2023-28432 CVE-2023-28432 POC Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIOSECRETKEY and MINIOROOTPASSWORD, resulting in...

dotenv-diff

dotenv-diff Scan your codebase to detect every environment variable reference. It helps you catch missing, unused, duplicated, and misused variables early, before they cause runtime errors. First class support for SvelteKit, Next.js, and Nuxt. Also works well in modern JavaScript/TypeScript...

patched-bash-4.3

patched-bash-4.3 patched-bash-4.3 for CVE-2014-6271 This is just bash 4.3 , pulled from the gnu website, and patched with the patches available on 9/26/2014, including the pkgsrc functionality changes that just disable the silly "execute functions in env variables" altogether. The patches are als...

CVE-2014-6271

🚨 CVE-2014-6271 — “Shellshock” 25-Year Zero-Day Remote Code Execution in GNU Bash via Environment Variables 📖 Overview CVE-2014-6271 , nicknamed Shellshock also known as Bashdoor, is a critical remote code execution RCE vulnerability in the GNU Bash shell. An attacker can send specially crafted...

CVE-2021-4034

CVE-2021- A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling...

CVE-2021-4034

CVE-2021-4034 This contains single-file exploit for cve-2021-4034 which is a Polkit Local Privilege Escalation. Use it wisely! Vulnerability Description CVE-2021-4034, commonly referred to as Pwnkit , is a memory corruption vulnerability in the pkexec component of Polkit, a toolkit used for...

Metabase_CVE-2021-41277

MetabaseCVE-2021-41277 Description Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential local file inclusion including environment variables. URLs...

unicorn

Unicorn Engine LOOKING FOR CONTRIBUTORS! See this. Unicorn is a lightweight, multi-platform, multi-architecture CPU emulator framework, based on QEMU. Unicorn offers some unparalleled features: Multi-architecture: ARM, ARM64 ARMv8, M68K, MIPS, PowerPC, RISCV, SPARC, S390X, TriCore and X86 16, 32,...

CVE-2023-36845

CVE-2023-36845 A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to control certain environments variables. Script Usage $ dos2unix CVE-2023-36845.sh $ CVE-2023-36845.sh example.co...

MagicMirror <= 2.35.0 - Server-Side Request Forgery

An unauthenticated Server-Side Request Forgery SSRF vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment...

CVE-2026-35585-poc

CVE-2026-35585: File Browser OS Command Injection PoC Description This repository contains a Proof of Concept PoC for CVE-2026-35585 , a critical OS Command Injection vulnerability discovered in File Browser versions 2.0.0 through 2.33.1. The vulnerability exists in the "Custom Command Hooks"...

CVE-2023-28432

CVE-2023-28432 MinIO has an information disclosure vulnerability. An unauthenticated remote attacker can obtain all environment variables by sending a specially crafted HTTP request, including MINIOSECRETKEY and MINIOROOTPASSWORD, causing sensitive information leakage, which may ultimately allow...

prowler

Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security...

httpstat

httpstat httpstat visualizes curl1 statistics in a way of beauty and clarity. It is a single file🌟 Python script that has no dependency👏 and is compatible with Python 3🍻. Features Beautiful terminal output — timing breakdown of DNS, TCP, TLS, server processing, and content transfer Structured JSO...

flan

Flan Scan is a lightweight network vulnerability scanner. With Flan Scan you can easily find open ports on your network, identify services and their version, and get a list of relevant CVEs affecting your network. Flan Scan is a wrapper over Nmap and the vulners script which turns Nmap into a...

CVE-2014-6271_pwnable

CVE-2014-6271 CVE-2014-6271 is a critical vulnerability known as "Shellshock", discovered and disclosed in 2014. This vulnerability was found in the Bash shell and affects almost all Unix and Linux systems, making it one of the most widely known vulnerabilities on the internet. Security Threat Th...

r2frida

r2frida Radare2 and Frida better together Description Self-contained plugin for radare2 that ships frida and allows to instrument local or remote processes using r2 commands instead but not limited to Frida scripts. The radare project provides a complete toolchain for reverse engineering, it's...

AWS-Loot

AWSLoot Searches an AWS environment looking for secrets, by enumerating environment variables and source code. This tool allows quick enumeration over large sets of AWS instances and services. Install pip install -r requirements.txt An AWS credential file .aws/credentials is required for...

CVE-2024-6678

CVE-2024-6678 - GitLab: Pipeline Schedule Arbitrary User Trigger PoC for CVE-2024-6678 Vulnerability Description GitLab allows users to manually trigger CI/CD pipeline schedules Pipeline Schedules via the "Play" button. The vulnerability lies in the fact that the "play" function allows any user...

CVE-2014-6271

Shellshock Exploitation CVE-2014-6271 Shellshock is effectively a Remote Command Execution vulnerability in BASH. This script exploits the vulnerability in the web environment on apache or similar with modcgi enabled. The vulnerability lies in the manipulation of environment variables, which are...