9015 matches found
CVE-2021-28663
CVE-2021-28663 针对 CVE-2021-28663 的基础信息泄露 PoC（Android 内核后门漏洞内幕） 这是针对 CVE-2021-28663 的基础 PoC。Mali GPU Android 内核驱动中存在一个设计缺陷。 1. 创建一个 GPUVA，并对其执行 mmap，这样我们就能获得物理页对应的虚拟地址。 2. 为物理页创建一个别名，但不要执行 mmap，这样 gpumapping 保持为 1。 3. 将 GPUVA 的标志修改为 BASEMEMDONTNEED。Mali 会将这些页置为可驱逐状态。 4. 由于我们已经持有别名页的 reg，现在可以对其执行...
cve-2025-29927
CVE-2025-29927 CVE-2025-29927 脆弱性 Next.js のバージョン 11.1.4 から 13.5.6、14.x の 14.2.25 未満、15.x の 15.2.3 未満のすべてのバージョンがこの脆弱性の影響を受けます。特に、アクセス制御を実装するためにミドルウェアに依存しているアプリケーションでは影響が大きく、攻撃者は認証なしで保護されたリソースに不正にアクセスできる可能性があります。 脆弱性のメカニズム CVE-2025-29927 の脆弱性は、Next.js が x-middleware-subrequest...
ets5-password-recovery
ETS5 密码恢复工具 目录 简介 安装 系统要求 密码恢复如何工作？ 设计缺陷是如何发现的？ 如何降低风险？ 协调漏洞披露 许可证 更新日志 简介 您是否忘记了某个 ETS5 项目的密码，无法再访问 KNX 安装的配置？ETS5 密码恢复工具可让您检索存储在 ETS5 项目存储中的项目密码和其他机密。这是因为 ETS5 存在一个严重的设计缺陷，它使用硬编码的密码和盐值来加密项目信息（CVE-2021-36799）。 将加密秘密存储在源代码中是不明智的，因为它们可以通过逆向工程软件恢复，因此提供的保护比以明文形式存储信息好不了多少。这可能对 KNX...
tech-seminar-React2Shell
React2Shell CVE-2025-55182 우리FISA 技術セミナー第6期 - 3チーム React Server ComponentRSCの設計欠陥を利用したリモートコード実行RCE脆弱性、React2Shellの分析及び研究 チーム...
CVE-2025-49844_POC
CVE-2025-49844POC POC de CVE-2025-49844 -h ver información de ayuda ··· Redis presenta una vulnerabilidad de ejecución remota de código en scripts Lua CVE-2025-49844. La causa principal de esta vulnerabilidad es un defecto de diseño en la interacción entre el motor de scripts Lua de Redis y la...
CVE-2020-0096-StrandHogg2
此设计缺陷使攻击者可以在另一个应用程序的顶部显示其自己的活动（页面），从而可能使用户迷失自己的私人数据。该漏洞被称为StrandHogg 2.0，最近由挪威安全公司Promon披露。 范围：理论上是全版本 android10测试失败了，测试8.0.1测试成功 验证步骤： 修改代码为目标app的包名和导出的activity 启动目标app的目标activity 启动测试app 在启动目标app发现劫持成功 LINKS https://source.android.com/security/bulletin/2020-05-01...
POC-2020-8558
概述 CVE-2020-8558 是一个 Kubernetes 漏洞，它之所以被公布，是因为 kube-proxy 意外地 让绑定到 localhost 的主机服务对网络上的其他节点可用。我特意强调"意外地"，是因为这个漏洞源于设计缺陷（疏忽），而非实现缺陷（bug）。代码确实做了它声称要做的事，但我们所有人都未能认识到这一决定的安全影响。 为了让主机进程能够通过 127.0.0.1（localhost）地址访问 NodePort 服务，kube-proxy 会设置 net.ipv4.conf.all.routelocalnet=1 这个 sysctl...
CVE-2026-42085
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, OpenC3 COSMOS contains a design flaw in the savetoolconfig function that allows saving tool configuration files at arbitrary locations...
CVE-2026-42085
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, OpenC3 COSMOS contains a design flaw in the savetoolconfig function that allows saving tool configuration files at arbitrary locations...
CVE-2025-66286
An API design flaw in WebKitGTK and WPE WebKit allows untrusted web content to unexpectedly perform IP connections, DNS lookups, and HTTP requests. Applications expect to use the WebPage::send-request signal handler to approve or reject all network requests. However, certain types of HTTP request...
CVE-2025-66286
An API design flaw in WebKitGTK and WPE WebKit allows untrusted web content to unexpectedly perform IP connections, DNS lookups, and HTTP requests. Applications expect to use the WebPage::send-request signal handler to approve or reject all network requests. However, certain types of HTTP request...
EUVD-2026-17585
The MS27102A Remote Spectrum Monitor is vulnerable to an authentication bypass that allows unauthorized users to access and manipulate its management interface. Because the device provides no mechanism to enable or configure authentication, the issue is inherent to its design rather than a...
CVE-2026-3356
The CVE-2026-3356 entry concerns the MS27102A Remote Spectrum Monitor, a device that exposes an authentication bypass vulnerability. The providedConnected documents (Red Hat, ENISA EUVD, NVD/NVD-related, CISA ICS advisory, AttackersKB, CVE listing, and PT-Security) consistently describe a flaw in...
CVE-2026-3356 Missing Authentication for Critical Function vulnerability in Anritsu Remote Spectrum Monitor
The MS27102A Remote Spectrum Monitor is vulnerable to an authentication bypass that allows unauthorized users to access and manipulate its management interface. Because the device provides no mechanism to enable or configure authentication, the issue is inherent to its design rather than a...
CVE-2026-30310
In its design for automatic terminal command execution, Sixth offers two options: Execute safe commands and Execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a command to be...
Sixth 安全漏洞
Sixth is an artificial intelligence code assistant developed by the Nigerian company Sixth. There is a security vulnerability in Sixth, which stems from its design, making it susceptible to prompt injection attacks, potentially leading to arbitrary command execution...
NVIDIA Isaac Launchable Arbitrary Code Execution Vulnerability
NVIDIA Isaac Launchable is a one-click deployment GPU development environment designed to simplify the AI development process and accelerate experimentation and deployment. NVIDIA Isaac Launchable suffers from a security vulnerability that stems from improper design and can be exploited by remote...
EUVD-2011-2100
Malware in sbrugna...