162 matches found
presentations
我的演讲 更多内容可以在我的个人网站找到：https://sites.google.com/site/zhiniangpeng root@kitploit: 利用 EXSi 中的预认证 RCE 与沙箱逃逸漏洞，Typhooncon 2023 OLE 对象今天依然危险 — 利用 Microsoft Office，POC 2023 Django-Simple-Captcha — JumpServer 预认证 RCE，Mosec BaijiuCon 2023 APT 对决 GPT，2023 年校园讲座 vSphere 攻防技法分享, KCON 2023 以新方式利用...
ZipExec
ZipExec ZipExec is a Proof-of-Concept POC tool to wrap binary-based tools into a password-protected zip file. This zip file is then base64 encoded into a string that is rebuilt on disk. This encoded string is then loaded into a JScript file that when executed, would rebuild the password-protected...
dcomhijack
DCOM DLL 劫持 我们最近发现以下 DCOM 类存在 DLL 劫持风险。如果攻击者能够写入关联路径，他们就可以通过实例化 COM 对象进行横向移动。某些类还有其他此处未列出的 DLL 劫持机会。 类| DLL 路径| 进程| 架构 ---|---|---|--- WordPad Document| C:\Program Files\Windows NT\Accessories\XmlLite.dll| wordpad.exe| x64 CLSIDContactReadingPane| C:\Program Files\Common Files\System\UxTheme.dll|...
Vulnerability fixed in Microsoft Developer Tools
Microsoft has fixed a vulnerability in Inbox COM Objects. A malicious party could exploit the vulnerability to execute arbitrary code in the context of the vulnerable application without prior authentication. Inbox Component Object Model COM objects is an architecture for developers to develop...
Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability
Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally...
Microsoft Windows SDK < 10.0.26100.7463 Inbox COM Objects (Global Memory) RCE (January 2026)
The version of Microsoft Windows SDK installed on the remote host is prior to 10.0.26100.7463. It is, therefore, affected by a remote code execution vulnerability: - Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally. CVE-2026-21219 Note that Nessus has no...
Microsoft Inbox COM Objects Code Execution Vulnerability
Microsoft Inbox COM Objects is a built-in COM component of the Windows operating system from the U.S. company Microsoft Microsoft. A code execution vulnerability exists in Microsoft Inbox COM Objects, which can be exploited by an attacker to execute arbitrary code on a system...
CVE-2025-58734
Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally...
CVE-2025-59282
Concurrent execution using shared resource with improper synchronization 'race condition' in Inbox COM Objects allows an unauthorized attacker to execute code locally...
CVE-2025-58738
Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally...
CVE-2025-58735
Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally...
CVE-2025-58734
Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally...
CVE-2025-58731
Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally...
CVE-2025-58732
Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally...
CVE-2025-58730
Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally...
CVE-2025-58730
Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally...
CVE-2025-58736 Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability
...
CVE-2025-58733
CVE-2025-58733 corresponds to a use-after-free in Inbox COM Objects on Windows that enables local code execution. Connected sources confirm Inbox COM Objects as the vulnerable component and describe the impact as arbitrary code execution by a local attacker. Public advisories from Microsoft and C...