204 matches found
CVE-2020-10977
GitLab v12.4.0-12.8.1 RCE Полностью основано на https://github.com/dotPY-hax/gitlabRCE, который не сработал для меня, и разбор HTML казался громоздким, поэтому я переписал его на js. Использование Запустите обработчик обратной оболочки обычным способом, затем выполните этот скрипт: root@kitploit:...
Node.js-CVE-2017-5941
NodeJS 안전하지 않은 역직렬화 취약점 데모 Node.js는 JavaScript로 서버 기능을 구현하는 데 사용되는 오픈 소스 런타임 환경입니다. Node.js 내 특정 소프트웨어 패키지에는 역직렬화를 처리하는 취약한 함수가 포함되어 있어, 클라이언트가 특수하게 조작된 쿠키를 제공하면 승인되지 않은 명령이 실행됩니다. 이 취약점은 재현되었으며, 잠재적으로 리버스 셸을 실행할 수 있습니다. 이는 클라이언트 요청의 쿠키에서 읽은 무결하지 않은 입력 데이터 때문에 가능합니다. 클라이언트는 자신의 쿠키를 수정하고, bash 명령을...
CVE-2026-2128
The Breeze WordPress Cache plugin (versions up to 2.5.2) is vulnerable due to improper verification of the wordpress_logged_in_ cookie in inc/cache/execute-cache.php when Cache Logged-in Users is enabled. An unauthenticated attacker can present a crafted cookie (e.g., wordpress_logged_in_fake=adm...
CVE-2026-46725
The extension passes an attacker-controlled cookie directly to PHP's unserialize without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation...
HTTP Response Splitting
Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to HTTP Response Splitting via the setCookie function. An attacker can cause runtime errors and potentially disrupt application behavior by supplying specially crafted input as the cookie...
CVE-2026-39324
Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. If cookie decryption fails, the implementation falls back to a default decoder instead of rejecting the cookie...
CVE-2021-31826
Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature. The flaw is exploitable for a daemon crash on systems not using this feature if a crafted cookie is supplied...
CVE-2025-69230
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, reading multiple invalid cookies can lead to a logging storm. If the cookies attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs...
CVE-2025-69230
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, reading multiple invalid cookies can lead to a logging storm. If the cookies attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs...
EUVD-2025-206084
NuCom 11N Wireless Router 5.07.90 contains a privilege escalation vulnerability that allows non-privileged users to access administrative credentials through the configuration backup endpoint. Attackers can send a crafted HTTP GET request to the backup configuration page with a specific cookie to...
VulnCheck KEV: CVE-2017-18365
The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to execute arbitrary code. This occurs because the enterprise session secret is always the same, and can be found in the product's source code. By sending a...
EUVD-2009-2262
Malware in sbrugna...
EUVD-2008-4983
Malware in sbrugna...
EUVD-2018-2167
Malware in sbrugna...
EUVD-2009-1576
Malware in sbrugna...
EUVD-2014-7117
Malware in sbrugna...
EUVD-2017-17181
Malware in sbrugna...
EUVD-2020-21401
Malware in sbrugna...