CVE-2020-13151-POC-Aerospike-Server-Host-Command-Execution-RCE-

CVE-2020-13151-POC-Aerospike-Server-Host-Command-Execution-RCE- संदर्भ: https://b4ny4n.github.io/network-pentest/2020/08/01/cve-2020-13151-poc-aerospike.html exploit.py - पायथन कोड चलाने के लिए...

cupspot-2024-47177

فخ CUPS نظرة عامة ينفّذ هذا المشروع فخًّا لالتقاط محاولات استغلال الثغرات الأمنية في نظام الطباعة الموحد CUPS Common UNIX Printing System. وتحديدًا، صُمّم لمراقبة محاولات الاستغلال المرتبطة بـ CVE-2024-47177. تسمح هذه الثغرة بتنفيذ أوامر عن بُعد عبر المعامل FoomaticRIPCommandLine في ملفات PPD. إذ...

aws-suture

संक्षेप में $ git clone [email protected]:pblittle/suture.git $ cd suture $ bundle install $ bundle exec ./bin/suture --help $ bundle exec ./bin/suture check Suture Suture एक ऐसा उपकरण है जो आपके AWS EC2 इंस्टेंस के विरुद्ध मनमाने कमांड चलाने के लिए है। आप इसे एक अलग इंस्टेंस या पूरे क्षेत्र...

CVE-2020-5902

CVE-2020-5902 F5 BIG-IP ट्रैफ़िक प्रबंधन उपयोगकर्ता इंटरफ़ेस TMUI रिमोट कोड निष्पादन BIG-IP संस्करणों 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, और 11.6.1-11.6.5.1 में, ट्रैफ़िक प्रबंधन उपयोगकर्ता इंटरफ़ेस TMUI, जिसे कॉन्फ़िगरेशन उपयोगिता भी कहा जाता है, में अज्ञात पृष्ठो...

Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF

Summary: 5 findings — BashTool shell-injection sink F6, the canonical RCE primitive, BackgroundRunTool async shell-injection sink F7, backtest execmodule runs top-level statements before the SignalEngine class check F8 — independent RCE path that does not match BashTool signatures, readurl outbou...

GHSA-JQMF-MX4F-HFR6 Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF

Summary: 5 findings — BashTool shell-injection sink F6, the canonical RCE primitive, BackgroundRunTool async shell-injection sink F7, backtest execmodule runs top-level statements before the SignalEngine class check F8 — independent RCE path that does not match BashTool signatures, readurl outbou...

CVE-2020-8816

CVE 2020-8816 : Pi-hole الإصدارات = 4.3.2 متأثر بثغرة تنفيذ الأوامر عن بُعد. يمكن للمستخدم المصادق على بوابة الويب تنفيذ أوامر عشوائية على الخادم الأساسي بصلاحيات المستخدم المحلي الذي يقوم بتشغيل الخدمة. مثال : go run CVE-2020-8816.go -host $LHOST -p $LPORT -pass admin -u...

CVE-2022-1388

CVE-2022-1388 CVE-2022-1388 F5 BIG-IP iControl REST Auth Bypass RCE. POST /mgmt/tm/util/bash HTTP/1.1 Host: Accept-Encoding: gzip, deflate Accept: / Connection: close, X-F5-Auth-Token, X-Forwarded-For, Local-Ip-From-Httpd, X-F5-New-Authtok-Reqd, X-Forwarded-Server, X-Forwarded-Host Content-type:...

CVE-2021-22986

भेद्यता प्रभाव यह भेद्यता अनधिकृत हमलावरों को, जिनके पास iControl REST इंटरफ़ेस तक नेटवर्क पहुँच है, BIG-IP प्रबंधन इंटरफ़ेस और स्वयं IP पतों के माध्यम से, मनमानी सिस्टम कमांड निष्पादित करने, फ़ाइलें बनाने या हटाने और सेवाओं को अक्षम करने की अनुमति देती है। इस भेद्यता का शोषण केवल कंट्रोल प्लेन क...

CVE-2026-82041

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...

CVE-2026-82041 UTMStack < 11.2.16 Missing Authorization via Command WebSocket

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...

CVE-2026-82041 UTMStack < 11.2.16 Missing Authorization via Command WebSocket

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...

CVE-2026-82041

UTMStack versions before 11.2.16 are vulnerable to a missing authorization flaw in the UTMIncidentCommandWebsocket.processCommand() function. Specifically, the handler mapped to the /command/{hostname} STOMP destination fails to perform role checks or apply a command allowlist. This allows any au...

CVE-2026-82041 UTMStack < 11.2.16 Missing Authorization via Command WebSocket

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...

EUVD-2026-91796

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...

CVE-2025-55182

RSC Detector - ماسح ثغرات مكونات خادم React ماسح أمني مبني على بايثون لاكتشاف واستغلال ثغرات مكونات خادم React RSC في تطبيقات Next.js. تقوم هذه الأداة بالكشف السلبي، وتحديد البصمة النشط، واختبار استغلال تنفيذ الأوامر عن بُعد RCE. ⚠️ تحذير : هذه الأداة مخصصة لاختبارات الأمن المصرح بها فقط. الوصول...

CVE-2019-15107

CVE-2019-15107 CVE-2019-15107 वेबमिन पायथन3 में लिखा गया है। उपयोग python CVE-2019-15107.py https://172.16.20.134:10000 whoami...

CVE-2019-10392_EXP

CVE-2019-10392EXP ثغرة تنفيذ أوامر عن بُعد بعد المصادقة في عميل Git الخاص بـ Jenkins CVE-2019-10392Exp الاستخدام usage: Jenkins Git Client 2.8.2. -h -u TARGET -U USERNAME -P PASSWORD -i ITEM -I INTERACTIVE -c COMMAND optional arguments: -h, --help show this help message and exit -u TARGET, --targ...

CVE-2022-29464

CVE-2022-29464 LOADER تثبيت وتشغيل التطبيق على الخادم user@domain: pip3 install colored user@domain: git clone https://github.com/sh4den/CVE-2022-29464-loader.git user@domain: cd ./CVE-2022-29464-loader/ user@domain: python3 main.py إخلاء مسؤولية هذا المستودع لأغراض أكاديمية، واستخدام هذا البرنام...

GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers

A critical flaw in GitLab's AI Gateway could let a logged-in user with Duo Agent Platform access run commands on the gateway under certain conditions, GitLab said in an advisory. The gateway is the service that connects a GitLab instance to AI models, and only organizations that host their own...