Openbsd-Privilege-Escalation

Openbsd-Escalada-De-Privilegios Un script que automatiza el proceso de escalar privilegios en el sistema OpenBSD CVE-2019-19520 explotando el binario xlock y obteniendo su sgid y escalando al usuario root mediante CVE-2019-19522 explotando los privilegios del grupo auth y agregando claves a Skey ...

CVE-2026-90474

MCPHub before 1.0.32 is affected by an authentication bypass in its embedded OAuth 2.0 authorization server. The root cause is that client authentication is disabled by default and PKCE enforcement is optional , allowing an attacker who intercepts an authorization code to redeem it for an access ...

gpgsm-cve-2026-57062-cms-gcm-short-tag

gpgsm CVE-2026-57062：CMS AES-GCM 短标签（USN-8720-1） GnuPG 的 gpgsm（S/MIME 和 CMS 工具）从 CMS AuthEnvelopedData（RFC 5083）AES-256-GCM 消息中的 mac OCTET STRING 派生其验证的身份验证标签长度，而 libgcrypt 接受短至 4 字节的标签。RFC 5084 要求至少 12 字节。Ubuntu 在 noble gnupg2 2.4.4-2ubuntu17.6 中通过拒绝任何短于 12 个八位字节的 authtag 修复了此问题。 这是一个概念验证：完全相同的伪...

cve-2022-36804

CVE-2022-36804：Atlassian Bitbucket Server 中的预认证 RCE 在 Atlassian Bitbucket Server 和 Data Center 的多个 API 端点中发现了一个严重命令注入漏洞。该漏洞影响所有版本低于 、、、、、 和 的 Bitbucket Server 和 Data Center。 CVE-2022-36804 实验环境 构建 Docker root@kitploit: docker build -t bitbucket . 运行 Docker root@kitploit: docker run -it bitbucket...

CVE-2023-27997-check

CVE-2023-27997 脆弱性評価ツール FortiGate SSL VPN インスタンスが CVE-2023-27997 に対して脆弱かどうかを、応答時間に基づいて安全に検出します。Bishop Fox のブログにある完全な解説記事（本ツールの背後にある手法の完全なウォークスルーを含む）を参照してください。 説明 CVE-2023-27997 は FortiGate の SSL VPN コンポーネントにおけるヒープベースのバッファオーバーフローであり、認証前のリモートコード実行（RCE）に悪用可能であることが実証されています。これはメモリ破損のバグであるため、sslvpnd...

CVE-2026-Discord

Informe de Vulnerabilidad Crítica: Cliente de Discord para macOS Fecha : 2026-01-25 Objetivo : Cliente de Discord macOS Stable 0.0.373 Autor : Antigravity 🚨 Resumen Ejecutivo Hemos identificado una vulnerabilidad de seguridad crítica en el Cliente de Discord para macOS basado en Electron que...

Teamsniper

Teamsniper Teamsniper 是一款用于在 Microsoft Teams 中提取关键词（如密码、电子邮件、数据库等）的工具。 用法 帮助选项 root@kitploit: usage: Teamsniper.py -h -d DATABASE -a AUTHTOKEN -s SEARCH Teamsniper is a tool for fetching the given keywords in Microsoft Teams. options: -h, --help show this help message and exit -d DATABASE,...

EUVD-2026-76742

An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value...

Linux Distros Unpatched Vulnerability : CVE-2026-90461

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...

CVE-2026-90461

OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...

CVE-2026-90449

CVE-2026-90449 affects a reverse proxy/gateway in an ICS/OT deployment (per the referenced CISA advisory icsa-26-254-01 ). When a particular authentication mode is configured, the reverse proxy forwards requests to a bundled third-party administrative interface without first applying the gateway'...

CVE-2026-90461

OpenStack Ironic versions through 38.0.0 may leak a username and password to an unexpected remote host when the Image Service is configured for HTTP(S) Basic Authentication . The credential disclosure results in a HIGH confidentiality impact with a changed scope , rated CVSS 3.1: 6.3 (Medium) due...

CVE-2026-90461

OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...

WordPress Tutor LMS – eLearning and online course solution plugin <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution vulnerability

Authenticated Subscriber+ PHP Object Injection to Remote Code Execution vulnerability discovered by Chloe Chamberland, Wordfence Argus in WordPress Plugin Tutor LMS versions = 4.0.7...

CVE-2026-85083 CareCam Pro IP Cameras Use of Hard-coded Credentials

The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical access to the device may leverage this weakness to gain privileged bootloader access, allowing unauthorized modification of firmware and system configuration and potentially...

CVE-2026-67309

A flaw was found in Traefik. This path traversal vulnerability exists in the Kubernetes Ingress NGINX provider's RewriteTarget middleware. A remote attacker can craft a special request that uses dot-segment traversal to bypass authentication mechanisms like BasicAuth, DigestAuth, or ForwardAuth...

CVE-2026-89175

Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability. Unauthenticated remote attackers can bypass authentication to access specific pages and obtain partial system configuration values...

CVE-2026-89175 Kingdom Communication Associated｜Smart Video Intercom System - Client-Side Authentication

Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability. Unauthenticated remote attackers can bypass authentication to access specific pages and obtain partial system configuration values...

PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws

PaperCut on Thursday released a new security maintenance release that replaces all previously published emergency patches that were pushed to address two security flaws that have come under active exploitation. The software development company said PaperCut NG/MF versions 26.0.5, 25.0.13 and...

Moderate: Red Hat Security Advisory: gstreamer1-plugins-base security update

An update for gstreamer1-plugins-base is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...