FuegoTest

FuegoTest FuegoTest 是一款命令行界面（CLI）工具，旨在检测 Cisco Firepower Management Center（FMC）中可能受 CVE-2023-20048 影响的设备。借助 rich 库，FuegoTest 提供了增强的用户体验，包括进度条和样式化文本的终端输出。 功能特性 使用提供的凭据对 Cisco FMC 进行身份验证。 获取并列出 FMC 管理的设备。 检测可能受 CVE-2023-20048 影响的设备。 终端输出增强：进度条和样式化文本。 前提条件 在开始之前，请确保满足以下要求： Python 3.6 或更高版本 用于安装依赖项的...

CVE-2026-66804-CrossDevice-Service-EoP

CVE-2026-66804: Elevación de Privilegios de la Cámara Virtual Cross Device Descubrí y reporté de forma independiente el problema que ahora se sigue como CVE-2026-66804. MSRC confirmó que mi envío era un duplicado de un informe anterior con la misma causa raíz subyacente de Windows Camera...

CVE-2026-100654

vLLM versions before 0.29.0 are vulnerable to a Denial of Service (DoS) attack. The issue arises because the POST /v1/completions and POST /v1/chat/completions endpoints accept user-controlled stop_token_ids but fail to verify if these IDs fall within the model's vocabulary/logits range. When min...

EUVD-2026-87725

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database querie...

CVE-2026-100631 Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database querie...

CVE-2026-100631 Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database querie...

CVE-2023-30765

CVE-2023-30765 CVE-2023-30765 / ZDI-23-905 - Delta Electronics Infrasuite Device Master 权限提升 漏洞发现者：Piotr Bazydło @chudypb 链接： https://www.zerodayinitiative.com/advisories/ZDI-23-905/ https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-01 使用方法 python3 cve-2023-30765.py -h usage:...

CVE-2025-57174

CVE-2025-57174 - Siklu EtherHaul Series - Ejecución Remota de Comandos sin Autenticación CVE-2025-57174 Ejecución Remota de Comandos sin Autenticación Versiones afectadas: Firmware 7.4.0 - 10.7.3 probablemente todas las versiones desde 7.4.0 Cómo usar python3 CVE-2025-57174.py 172.16.100.52...

Sapito

Sapito Autores: Sebastian Garcia [email protected], @eldracote, Veronica Valeros [email protected], @verovaleros Acerca de Sapito Sapito es un sniffer e intérprete de DNS multicast mDNS escrito en Python. Sapito captura paquetes de un pcap o de una interfaz e interpreta los hallazgos...

CVE-2020-35262

CVE-2020-35262: XSS Almacenado en el Router Digisol DG-HR3400 Descripción de la Vulnerabilidad Se ha identificado que el endpoint vulnerable no tiene validación de entrada en el lado del servidor y carece de filtrado en el lado del cliente para cualquier inyección de script malicioso. Un atacante...

EUVD-2026-87470

OpenClaw for iOS before 2026.8.11 stores Gateway credentials as cleartext JSON in App Group UserDefaults instead of the device Keychain. Attackers with access to unencrypted device backups or extracted App Group containers can recover valid Gateway tokens and passwords to authenticate with operat...

SUSE CVE-2026-98106

In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: Prevent double migration of device pages A device-private folio migrated to system memory by a CPU fault can remain reachable through the raw-PFN eviction path until migration finalization drops the source reference...

d-os-descriptor

d-os-descriptor Resumen El subsistema USB Gadget incluye problemas de seguridad en la sección de manejo de descriptores de sistema operativo OS de la función compositesetup composite.c. El procesamiento de mensajes de solicitud de transferencia de control debidamente elaborados provoca un bloqueo...

Azure-App-Tools

Azure-App-Tools Colección de herramientas para usar con aplicaciones de Azure. https://azure.microsoft.com/en-us/get-started/apps/ Requisitos previos Módulo de Azure PowerShell https://docs.microsoft.com/en-us/powershell/azure/install-az-ps?view=azps-3.8.0 Ejemplos: Códigos de dispositivo dinámic...

CVE-2026-17545

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...

CVE-2026-17545 PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...

EUVD-2026-87329

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...

CVE-2026-17545

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...

CVE-2026-17545

On Windows , PHP's filesystem and stream APIs fail to reject reserved system device names (such as CON , PRN , AUX , NUL , COM1 to COM9 , LPT1 to LPT9 , CONIN$ , and CONOUT$ ) when they are used as path components. An attacker who can control file or stream paths can supply these reserved names t...

Juniper-exploit-CVE-2023-36845

CVE-2023-36845 描述 CVE-2023-36845 是一项值得注意的 PHP 环境变量操纵漏洞，影响 Juniper SRX 防火墙和 EX 交换机。虽然 Juniper 将此漏洞归类为中等严重性，但在本文中，我们将阐述如何利用这一单一漏洞实现远程、未经身份验证的代码执行。 搜索 - Shodan title:"Juniper Web Device Manager" title:"Juniper" http.favicon.hash:2141724739 使用方法 🛠 检测 python3 CVE-2023-36845.py -f targets.txt -o...