Introducing the Prompt Airlines CTF: Test Your AI Security Skills

Wiz is excited to announce "Prompt Airlines," a new cloud security Capture The Flag CTF event focused on AI vulnerabilities...

Exploit for Unrestricted Upload of File with Dangerous Type in Chamilo Chamilo_Lms

CVE-2023-4220-Exploit LMS Chamilo 1.11.24 CVE-2023-4220 Explo...

Exploit for Code Injection in Reportlab

CVE-2023-33733-POC Disclamer I did not, nor do I take credi...

GZ::CTF 安全漏洞

GZ::CTF is an open source CTF platform based on ASP.NET Core by GZTime Individual Developers. A security vulnerability exists in GZ::CTF versions prior to 0.20.1, which originates from a cross-site scripting attack that can be performed by an unprivileged user on other users by constructing a...

CVE-2024-34699: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

GZ::CTF is a capture the flag platform. Prior to 0.20.1, unprivileged user can perform cross-site scripting attacks on other users by constructing malicious team names. This problem has been fixed in v0.20.1...

CVE-2024-34699 GZ::CTF allows unprivileged user can perform XSS attacks by constructing malicious team names.

GZ::CTF is a capture the flag platform. Prior to 0.20.1, unprivileged user can perform cross-site scripting attacks on other users by constructing malicious team names. This problem has been fixed in v0.20.1...

CVE-2024-34699

GZ::CTF (prior to v0.20.1) is vulnerable to cross-site scripting by unprivileged users attempting to craft team names; fixed in v0.20.1. The CVE-2024-34699 entry shows CVSS 3.1 base score 6.5 (Medium) with Adjacent access, no privileges, user interaction none, and high availability impact. Remedi...

CVE-2024-34699 GZ::CTF allows unprivileged user can perform XSS attacks by constructing malicious team names.

GZ::CTF is a capture the flag platform. Prior to 0.20.1, unprivileged user can perform cross-site scripting attacks on other users by constructing malicious team names. This problem has been fixed in v0.20.1...

CVE-2024-34699

GZ::CTF is a capture the flag platform. Prior to 0.20.1, unprivileged user can perform cross-site scripting attacks on other users by constructing malicious team names. This problem has been fixed in "v0.20.1"...

Nginx 1.25.5 Host Header Validation Vulnerability

Nginx versions 1.25.5 and below appear to have a host header filtering validation bug that could possibly be used for malice. Nginx = 1.25.5 $host variable validation bug Intro: In the "Host" header sent to Nginx web server you can't just insert a dot or something like that, because a filtering...

Internet Bug Bounty: Libuv: Improper Domain Lookup that potentially leads to SSRF attacks

The vulnerability in the libuv library was caused by the improper truncation of hostnames to 256 characters before calling the getaddrinfo function. This behavior allowed the creation of addresses like 0x00007f000001, which were considered valid by getaddrinfo, potentially leading to SSRF attacks...

Announcing the K8s LAN Party Challenge

Test your investigation skills and K8s network knowledge in a new CTF event: the K8s LAN Party Challenge!...

Exploit for Injection in Vm2_Project Vm2

CVE-2023-30547 This is a Proof-of-Concept to CVE-2023-30547 h...

Exploit for Out-of-bounds Write in Polkit_Project Polkit

CVE-2021-4034-CTF-writeup This is a CTF pwn challenge that I w...

Exploit for Out-of-bounds Write in Polkit_Project Polkit

CVE-2021-4034-CTF-writeup This is a CTF pwn challenge that I w...

Malicious code in akshansh-jaiswal-ctf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e79dc91fb9132fecd68a7df07720fafb95435158a6e8cda639e03e9f307605e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in akshansh-jaiswal-ctf

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in akshansh-jaiswal-ctf-security (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1a21cd8cd0f3e40599808c19641304a3f52f263a31d9b68e9847bc4c6933cc80 The OpenSSF Package Analysis project identified 'akshansh-jaiswal-ctf-security' @ 99.9999.9999 npm as malicious. It is considered malicious...

Restricted vim sandbox escape

Description Restricted vim doesn't allow executing shell commands but it's possible to bypass this by setting GCONVPATH environment variable. I'm not sure if this can be consider a vulnerability but I decided to report it anyway found this while playing TeamItaly CTF . Proof of Concept Save this...

CVE-2023-3269

creationtimestamp| type| source ---|---|--- 2023-07-05 12:39:14+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/4687 2023-07-06 07:00:05+00:00| published-proof-of-concept| https://t.me/TopCyberTechNews/353 2023-07-06 11:55:35+00:00| seen| https://t.me/truesecator/4584 2023-07-06...