VulnerableDotNetHTTPRemoting

Vulnerable Dot Net HTTP Remoting Project Este repositorio contiene una aplicación vulnerable en C cliente/servidor que usa .NET Remoting a través de HTTP. Puede utilizarse con fines de prueba y puede compilarse con diferentes versiones de .NET Framework. También incluye una copia de ysoserial.net...

HttpRemotingObjRefLeak

通过 HTTP .NET Remoting 泄露和利用 ObjRef（CVE-2024-29059） 本仓库进一步提供了关于 CODE WHITE 同名博文 Leaking ObjRefs to Exploit HTTP .NET Remoting 的详细信息和资源： 1. 创建易受攻击的 ASP.NET Web 应用程序 2. 检测 ObjRef 泄漏 3. 在 TypeFilterLevel.Low 限制下可工作的示例反序列化载荷 4. 用于投递载荷的利用脚本 1. 创建易受攻击的 ASP.NET Web 应用程序 以下内容基于 Microsoft 的《为 ASP.NET 网站配置...

CVE-2019-7214

CVE-2019-7214 root@kitploit: Exploit Title: SmarterMail...

CVE-2022-31199

CVE-2022-31199 - Netwrix Auditor RCE 漏洞利用 POC 🔍 漏洞概述 CVE-2022-31199 是 Netwrix Auditor 10.5 之前版本中存在的一个严重的不安全对象反序列化漏洞。该漏洞存在于监听 TCP 9004 端口的未受保护的 .NET Remoting 服务中，允许未经身份验证的远程攻击者以 NT AUTHORITY\SYSTEM 权限实现任意代码执行。 漏洞详情 CVE ID : CVE-2022-31199 CVSS 评分 : 9.8 严重 CWE : CWE-502 不可信数据的反序列化 受影响版本 : Netwrix...

CVE-2023-35813_PoC

curl -k -v -X POST "https://target/sitecorexaml.ashx/-/xaml/Sitecore.Xaml.Tutorials.Styles.Index" -H "Content-Type: application/x-www-form-urlencoded" --data-urlencode "ISEVENT=1" --data-urlencode "SOURCE=" --data-urlencode "PARAMETERS=ParseControl" ""...

CVE-2026-58127

PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerEngine.dll, registered with ObjectURIs RemoteObj and UIRemoteObj, without any authentication requirement. By exploiting the MarshalByRefObject object unmarshalling technique and implementing .NET...

CVE-2026-25550

Seagull Software BarTender 2010, 2016, and 2019 contain an unauthenticated remote code execution vulnerability in the .NET Remoting service exposed on TCP port 7375 via BtSystem.Service.exe. The service registers an unauthenticated singleton endpoint — BarTenderSystem for BarTender 2016 = R9, and...

CVE-2026-0611

Spacelabs Healthcare Sentinel versions 10.5.x and higher and 11.x.x before 11.6.0 contain an unauthenticated remote code execution vulnerability through a deprecated .NET Remoting HTTP channel exposed on port 8989 that allows attackers to perform arbitrary file read and write operations by...

CVE-2026-25551

Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that allows low-privileged local users to escalate privileges. The DataServiceSingleton .NET Remoting endpoint is bound to localhost on TCP port 7375 via BtSystem.Service.exe, limiting the attack...

EUVD-2026-34306

Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that allows low-privileged local users to escalate privileges. The DataServiceSingleton .NET Remoting endpoint is bound to localhost on TCP port 7375 via BtSystem.Service.exe, limiting the attack...

CVE-2026-25551

Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that allows low-privileged local users to escalate privileges. The DataServiceSingleton .NET Remoting endpoint is bound to localhost on TCP port 7375 via BtSystem.Service.exe, limiting the attack...

CVE-2026-25550 Seagull Software BarTender Unauthenticated RCE via .NET Remoting Service

Seagull Software BarTender 2010, 2016, and 2019 contain an unauthenticated remote code execution vulnerability in the .NET Remoting service exposed on TCP port 7375 via BtSystem.Service.exe. The service registers an unauthenticated singleton endpoint — BarTenderSystem for BarTender 2016 = R9, and...

CVE-2026-25550 Seagull Software BarTender Unauthenticated RCE via .NET Remoting Service

Seagull Software BarTender 2010, 2016, and 2019 contain an unauthenticated remote code execution vulnerability in the .NET Remoting service exposed on TCP port 7375 via BtSystem.Service.exe. The service registers an unauthenticated singleton endpoint — BarTenderSystem for BarTender 2016 = R9, and...

PT-2026-46297

Name of the Vulnerable Software and Affected Versions BarTender 2010 BarTender 2016 versions prior to R10 BarTender 2019 versions prior to R11 Description An unauthenticated remote code execution issue exists in the .NET Remoting service exposed on TCP port 7375 via BtSystem.Service.exe. The...

CVE-2026-0611

Summary: CVE-2026-0611 affects Spacelabs Healthcare Sentinel 10.5.x and higher and Sentinel 11.x.x prior to 11.6.0. A deprecated .NET Remoting HTTP channel exposed on port 8989 allows unauthenticated remote code execution by supplying valid .NET URI endpoints, enabling arbitrary file read/write a...

CVE-2025-15610

The .NET Remoting framework used by OpenText Fax RightFax includes known security vulnerabilities that could be exploited if the service is exposed in environments where the remoting ports are accessible...

CVE-2026-23751

Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 other versions may be affected exposes a deprecated .NET Remoting HTTP channel on port 2424 via the Ascent Capture Service that is accessible without authentication and uses a default, publicly known endpoint identifier. An...

EUVD-2026-25228

Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 other versions may be affected exposes a deprecated .NET Remoting HTTP channel on port 2424 via the Ascent Capture Service that is accessible without authentication and uses a default, publicly known endpoint identifier. An...

CVE-2026-23751

Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 other versions may be affected exposes a deprecated .NET Remoting HTTP channel on port 2424 via the Ascent Capture Service that is accessible without authentication and uses a default, publicly known endpoint identifier. An...

EUVD-2026-22724

Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose a deprecated .NET Remoting TCP channel that allows remote unauthenticated attackers to leak NTLMv2 machine-account hashes by supplying a Windows UNC path as a target file argument through object-unmarshalling...