tethr

Tethr 안드로이드 테더링 프로비저닝 검사 우회 CVE-2017-0554 이 저장소는 안드로이드 7.1.2 이전 버전에서 테더 프로비저닝 검사를 우회하는 CVE-2017-0554를 증명하는 개념 증명 Tethr 앱을 위한 것입니다. 정보 블로그 게시물 Tethr 다운로드 데모 비디오...

polkit-CVE-2021-3560_writeup

Try Hack Me - Polkit:CVE-2021-3560 작성자: Atharva Bordavekar 난이도: 정보 포인트: 32 취약점: CVE-2021-3560 먼저 polkit 버전을 확인하여 더 나은 통찰력을 얻을 것입니다. root@kitploit: apt list --installed | grep policykit-1 policykit-1/focal,now 0.105-26ubuntu1 amd64 installed,upgradable to: 0.105-26ubuntu1.1 저는 deepseek를 사용하여 polic...

CVE-2026-52886

경로 탐색: startswith 접두사 검사 우회 Notepad++ —session.xml backupFilePath 탐색을 통한 임의 파일 읽기 권고 GHSA: GHSA-rqfm-pw34-r7j6 CVE: CVE-2026-52886 심각도: 보통 영향받는 버전: v8.9.6.4 패치된 버전: v8.9.7 패치 커밋: 7e66f36 영향받는 파일: PowerEditor/src/Notepadplus.cpp 세션 복원 — backupFilePath 검증 플랫폼: Windows 11 Pro x64 필요 권한: 표준 사용자...

CVE-2025-6554

CVE-2025-6554 root@kitploit: function leakhole let x; delete x?.y?.a; return y; let y; function pwn let hole = leakhole; %DebugPrinthole; pwn; Ошибка Переменная y была доступна до объявления. Обычно это должно вызывать ReferenceError TDZ, но в старых версиях V8 при комбинации с delete x?.y провер...

DolibabyPhp

DolibabyPhp Аутентифицированный RCE-эксплойт для Dolibarr ERP/CRM CVE-2023-30253. Установка Пакет можно установить из репозитория PyPi с помощью pip или склонировать исходный код напрямую с GitHub. root@kitploit: pip install dolibabyphp Использование root@kitploit: Usage: dolibabyphp OPTIONS...

CVE-2021-24356

CVE-2021-24356 Simple 301 Redirects от BetterLinks - 2.0.0 – 2.0.3 - Подписчик + Произвольная установка плагинов Описание Отсутствие проверок прав и недостаточная проверка nonce в AJAX-действии плагина позволили аутентифицированным пользователям устанавливать произвольные плагины на уязвимых...

CVE-2026-57216

A flaw was found in RabbitMQ, a messaging and streaming broker. The AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication mechanisms incorrectly perform a loopback check. This allows a user, typically restricted to loopback connections such as a guest user, to connect remotely. This occurs whe...

spectre-attack-example

Spectre 공격 예제 2018년 1월 2일 CVE-2017-5753 및 CVE-2017-5715 "유령" Spectre 취약점 이용 예시 이게 뭔가요? 우리는 "The Magic Words are Squeamish Ossifrage." 라는 텍스트를 메모리에 저장하고, 취약점을 이용해 이를 읽으려고 시도합니다. 시스템이 취약하다면, 표준 출력에서 동일한 텍스트를 볼 수 있습니다. 이 코드에서, victimfunction 내의 컴파일 명령이 엄격한 프로그램 순서로 실행된다면, 해당 함수는 array1 크기 = 16이므로...

CVE-2026-56865

A flaw was found in golang.org/x/mod/sumdb/tlog. A malicious Go proxy GOPROXY could exploit this vulnerability by forging sumdb tiles. This allowed the proxy to bypass integrity checks and serve malicious module content to a local Go module cache, which would then go undetected by the transparenc...

CVE-2026-53541

OliveTin gives access to predefined shell commands from a web interface. The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a specia...

CVE-2026-66797

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...

collision-webshell

Webshell 衝突 このリポジトリには、同じ MD5 ハッシュを持つ 2 つのファイルが含まれています: webshell.php normal.php ファイルの MD5: root@kitploit: $ md5sum .php b719a17ae091ed45fb874c15b2d9663f normal.php b719a17ae091ed45fb874c15b2d9663f webshell.php webshell.php の Hexdump: root@kitploit: $ hexdump -C webshell.php 00000000 3c 3f 3d 65 76...

Linux Distros Unpatched Vulnerability : CVE-2026-68554

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an...

Kibana 9.2.x < 9.4.5 Incorrect Authorization (ESA-2026-82)

The version of Kibana installed on the remote host is 9.2.x prior to 9.4.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-82 advisory. - Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the...

CVE-2026-54464

A flaw was found in the websocket-driver library. When used with the permessage-deflate extension, a remote attacker can send compressed WebSocket messages that, upon decompression, exceed the configured maximum message size. This occurs because the size limit is checked against the compressed da...

CVE-2026-67447

Mailpit (email testing tool) versions 1.30.0–1.30.4 contain a post-fix gap in the SMTP DATA reader (internal/smtpd/smtpd.go, readData()). The function calls bufio.Reader.ReadBytes('\n') before enforcing the configured MaxMessageSize cap, so a single oversized DATA line is fully allocated in memor...

CVE-2026-74306

A flaw was found in the Linux kernel's vfio/qat driver. This vulnerability involves a race condition in the qatvfresumewrite function, where concurrent operations can bypass a critical bounds check. This allows data to be written beyond the intended memory area, potentially corrupting system...

EUVD-2026-63078

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMA...

XWiki Platform Live Data Live Table Connector has privilege escalation from edit to script right through Live Data editing

Impact Any user who can edit a page in XWiki can use Live Data's edit REST API in XWiki to change the rights on that page. This allows the user to obtain script right on the page. Script right allows the user to execute potentially dangerous Velocity scripts and send unfiltered HTML and JavaScrip...

CVE-2026-55648

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, freerdpimagecopyfromicondata in libfreerdp/codec/color.c calculates nWidth multiplied by nHeight multiplied by FreeRDPGetBytesPerPixelformat in 32-bit arithmetic. A malicious RDP server can send a RAIL TSICONINFO...