Apache Flink - Local File Inclusion

Apache Flink 1.11.0 and released in 1.11.1 and 1.11.2 as well allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process aka local file inclusion. id: CVE-2020-17519 info: name: Apache Flink - Local File Inclusion author: pdtea...

WordPress InfiniteWP <1.9.4.5 - Authorization Bypass

WordPress InfiniteWP plugin before 1.9.4.5 for WordPress contains an authorization bypass vulnerability via a missing authorization check in iwpmmbsetrequest in init.php. An attacker who knows the username of an administrator can log in, thereby making it possible to obtain sensitive information,...

OpenTSDB <=2.4.0 - Remote Code Execution

OpenTSDB 2.4.0 and earlier is susceptible to remote code execution via the yrange parameter written to a gnuplot file in the /tmp directory. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary...

OsTicket < 1.14.3 - Server Side Request Forgery

SSRF vulnerability exists in osTicket before 1.14.3, allowing an attacker to add malicious files to the server or perform port scanning. id: CVE-2020-24881 info: name: OsTicket 1.14.3 - Server Side Request Forgery author: hnd3884 severity: critical description: | SSRF vulnerability exists in...

SEOWON INTECH SLC-130 & SLR-120S - Unauthenticated Remote Code Execution

SEOWON INTECH SLC-130 and SLR-120S devices allow remote code execution via the ipAddr parameter to the systemlog.cgi page. id: CVE-2020-17456 info: name: SEOWON INTECH SLC-130 & SLR-120S - Unauthenticated Remote Code Execution author: gy741,edoardottt severity: critical description: SEOWON INTECH...

Tenda AC15 AC1900 version 15.03.05.19 - Command Injection

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter. id: CVE-2020-10987 info: name: Tenda AC15 AC1900 version 15.03.05.19 - Command Injection author: pussycat0x severity: critical...

Oracle Weblogic Server - Remote Command Execution

Oracle WebLogic Server contains an easily exploitable remote command execution vulnerability which allows unauthenticated attackers with network access via HTTP to compromise the server. id: CVE-2020-14882 info: name: Oracle Weblogic Server - Remote Command Execution author: dwisiswant0 severity:...

VMware vCenter Server LDAP Broken Access Control

Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller PSC, does not correctly implement access controls. id: CVE-2020-3952 info: name: VMware vCenter Server LDAP Broken Access Control author: 0xAkoko severity: critic...

EyesOfNetwork - Hardcoded API Key & SQL Injection

An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the username field to getApiKey in include/apifunctions.php. id: CVE-2020-8656 info: name:...

CNVD-2020-10487

説明 本ツールはセキュリティ研究および内部確認専用です。不正な攻撃に使用することは禁止されており、生じた結果は使用者が負うものとします。 Apache Tomcatファイルインクルード脆弱性（CVE-2020-1938 / CNVD-2020-1048）の一括検出ツール。 このプロジェクトはKit4yのプロジェクトをベースに修正を加えたものです。 コード修正 ip.txtにドメインまたはIPが1つしかない場合、threadCountが1になりプログラムが実際に実行されないため、スレッド数を判定するコードを追加しました。 root@kitploit: ... if threadCount ...

CVE-2020-0796-RCE-POC

CVE-2020-0796 Remote Code Execution POC c 2020 ZecOps, Inc. - https://www.zecops.com - Find Attackers' Mistakes Remote Code Execution POC for CVE-2020-0796 / "SMBGhost" Expected outcome: Reverse shell with system access. Intended only for educational and testing in corporate environments. ZecOps...

CVE-2020-0796-POC

CVE-2020-0796 Pre-Auth POC c 2020 ZecOps, Inc. - https://www.zecops.com - Find Attackers' Mistakes POC to check for CVE-2020-0796 / "SMBGhost" Expected outcome: Blue Screen Intended only for educational and testing in corporate environments. ZecOps takes no responsibility for the code, use at you...

SMBGhost

SMBGhost Simple scanner for CVE-2020-0796 - SMBv3 RCE. The scanner is for meant only for testing whether a server is vulnerable. It is not meant for research or development, hence the fixed payload. It checks for SMB dialect 3.1.1 and compression capability through a negotiate request. A network...

CVE-2020-3452

CVE-2020-3452 TL;DR This is an exploit for CVE-2020-3452. It's not entirely finished yet. Use it in legal context. If you fuck up it's your problem. W00t is dis? This is a quick'n dirty try to enhance the original PoC of CVE-2020-3452. At the current stage there is nothing more than a simple py...

CVE-2020-0796-LPE-POC

CVE-2020-0796 Local Privilege Escalation POC c 2020 ZecOps, Inc. - https://www.zecops.com - Find Attackers' Mistakes POC to check for CVE-2020-0796 / "SMBGhost" Expected outcome: cmd.exe launched with system access Intended only for educational and testing in corporate environments. ZecOps takes...

nodejs-http-transfer-encoding-smuggling-poc

nodejs-http-transfer-encoding-smuggling-poc PoC of HTTP Request Smuggling in nodejs CVE-2020-8287 src/index.js root@kitploit: header: 'Host', '127.0.0.1', 'Transfer-Encoding', 'chunked', 'Transfer-Encoding', 'eee' , body: 'A' header: 'Host', '127.0.0.1' , body: '' data: 'HTTP/1.1 200 OK\r\n' +...

CVE-2020-8165

README この README は通常、アプリケーションを起動して実行するために必要な手順を文書化します。 以下は記載すべき項目の例です。 Ruby バージョン システム依存関係 設定 データベース作成 データベース初期化 テストスイートの実行方法 サービス（ジョブキュー、キャッシュサーバー、検索エンジンなど） デプロイ手順...

SMBCompScan

SMBCompScan CVE-2020-0796 に対して脆弱なホストを特定するスキャナスクリプト アドバイザリ 免責事項 このスクリプトは、圧縮が有効になっているかどうかをチェックすることで、SMBv3 の脆弱性を持つマシンを特定するのに役立ちます。ただし、KB4551762 がインストールされているマシンに対して「vulnerable」を返す可能性があります。 必要条件 Perl 5.12+ IO::Socket Net::Netmask 使い方 単一のIPアドレスをスキャン: root@kitploit: ./smbCompScan.pl 192.168.0.1 ホスト名でスキャ...

salt-security-backports

以前のバージョンの公式パッチは以下でリクエストできます: https://www.saltstack.com/lp/request-patch-april-2020/ ⚠ ここのパッチはカスタムであり、公式のものとは異なる場合があります ⚠ サポートされていない Salt バージョン向けのバックポートされたセキュリティパッチ このリポジトリのパッチは以下の CVE に対応しています: CVE-2020-11651 および CVE-2020-11652 - https://labs.f-secure.com/advisories/saltstack-authorization-bypass...

rauc-1.5-integration

Integrating RAUC 1.5 This repository contains examples to simplify integrating the RAUC update into existing projects. You can subscribe to https://github.com/rauc/rauc-1.5-integration/issues/1 to receive notifications of important updates to this repository and of integration into the upstream...