CVE-2014-0160

💔 CVE-2014-0160 — "Heartbleed" 📖 目录 概述 技术背景 根本原因 影响范围 受影响版本 利用概述 缓解与补丁 时间线 经验教训 总结 🔎 概述 Heartbleed 是 CVE-2014-0160 的俗称，是 OpenSSL 的 TLS 心跳扩展中的一个严重漏洞。 它允许远程攻击者无需认证即可从易受攻击的服务器每次请求读取最多 64 KB 的内存 。 这泄露了以下敏感信息： 🔐 私有 SSL 密钥 👤 用户凭证 🍪 会话 Cookie 📧 电子邮件 💳 内存中存储的敏感数据 🧠 技术背景 OpenSSL 实现了 TLS 协议，用于保护 HTTPS 连接。...

CVE-2015-3337

CVE-2015-3337 CVE-2015-3337 任意文件读取 http://10.10.20.166:9200/plugin/head/../../../../../../../../../etc/passwd Usage: python CVE-2015-3337.py root@kitploit: python CVE-2015-3337.py / \ | | | | / | |/ | | | | || || || / | / / | | | | ' / /'| |/' || | | \ / / / / / / / / | | | | | | || / / | /| | |...

citrix_bleed_2

Citrix Bleed 2 PoC Scanner CVE-2025-5777 This script is a Proof-of-Concept PoC scanner for the hypothetical vulnerability "Citrix Bleed 2" CVE-2025-5777. It is designed to detect potential memory leaks from Citrix ADC devices by sending oversized requests and analyzing the responses for sensitive...

CVE-2024-32369

CVE-2024-32369 描述： HSC Cybersecurity HSC Mailinspector v.5.2.17-3 中存在 SQL 注入漏洞，允许远程攻击者通过向 mliWhiteList.php 组件的 start 和 limit 参数发送特制载荷来获取敏感信息。 版本： 发现于 HSC Mailinspector 5.2.17-3，但适用于所有版本至 5.2.18。 概念验证 SQL 注入漏洞存在于应用程序请求载荷的 limit 参数中。具体来说，载荷 exec=fetch&start=0&limit=30' 存在 SQL 注入风险。...

r3con

R3CON Multifunctional Web Recon & Vulnerability Scanner Tool r3con is a Multifunctional Web Recon & Vulnerability Scanner Tool and incredibly fast crawler that can find multiple vulnerabilitys and gather information. Check for vulnerabilities Reflected XSS Multi-threaded crawling Open-redirection...

HijackLibs

HijackLibs Este proyecto tiene como objetivo mantener un registro de las oportunidades de secuestro de DLL divulgadas públicamente. Puede encontrar la versión web de este repositorio en https://www.hijacklibs.net. Licencia : GPLv3.0 Código de Conducta : Contributor Covenant Guía de contribución...

Identificador-CVE-2018-11759

其他语言 git - pt-BR 检查你的实例是否暴露了 CVE 2018-11759 文件 main 是一个用于利用漏洞的 bash 脚本。 URL 必须使用协议和完整地址，例如：https://test.site.com.br 如需在一次查询中使用多个 URL，可以使用 here-document，例如： root@kitploit: Call the bash, no request permission for exec bash main EOF https://vulpagepagevul.com http://pamonhaemandioca.gov.br...

Fortinet - Authentication Bypass

Fortinet FortiOS is vulnerable to an information disclosure via service-worker.js that could allow an attacker to access sensitive information.This vulnerability affects FortiOS and could potentially lead to unauthorized access to the system. id: CVE-2024-55591 info: name: Fortinet - Authenticati...

Apache NiFi - Information Disclosure

Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to a Parameter Context, but in cases wher...

Discourse Backup File Disclosure Via Default Nginx Configuration

Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use FileStore--LocalStore which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick...

All-in-One WP Migration < 7.87 - Unauthenticated Information Disclosure

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to unauthenticated information disclosure due to its error.log file being publicly accessible in versions before 7.87. id: CVE-2024-8852 info: name: All-in-One WP Migration 7.87 - Unauthenticated Information Disclosure...

rConfig <3.9.4 - Sensitive Information Disclosure

rConfig prior to version 3.9.4 is susceptible to sensitive information disclosure. An unauthenticated attacker can retrieve saved cleartext credentials via a GET request to settings.php. Because the application does not exit after a redirect is applied, the rest of the page still executes,...

Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-tls-match-cn` Annotation

A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the auth-tls-match-cn Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of...

Jenkins <=2.218 - Information Disclosure

Jenkins through 2.218, LTS 2.204.1 and earlier, is susceptible to information disclosure. An attacker can access exposed session identifiers on a user detail object in the whoAmI diagnostic page and thus potentially access sensitive information, modify data, and/or execute unauthorized operations...

IP2Location Country Blocker < 2.38.9 - Unauthenticated Information Disclosure

IP2Location Country Blocker plugin for WordPress up to version 2.38.8 contains a regular information exposure caused by missing capability checks on admininit, letting unauthenticated attackers view plugin settings, exploit requires no special conditions. id: CVE-2025-1361 info: name: IP2Location...

XWiki - Information Disclosure

XWiki 16.7.0 to 16.10.11, 17.4.4, and 17.7.0 using XJetty contains an information disclosure vulnerability caused by exposed context allowing static access to files in webapp/ folder, letting attackers access sensitive files, exploit requires use of XJetty package. id: CVE-2025-55749 info: name:...

Squid Proxy - HTTP Authentication Credentials Disclosure

Squid versions prior to 7.2 fail to redact HTTP authentication credentials in error page responses. The Authorization header value is embedded in plain text inside the mailto: diagnostic block when Squid generates an error page e.g. ERRDNSFAIL. id: CVE-2025-62168 info: name: Squid Proxy - HTTP...

TRUfusion Enterprise <= 7.10.4.0 - Admin Contact Portal

TRUfusion Enterprise versions 7.10.4.0 and earlier contained a vulnerability that allowed unauthenticated access to the Internal Admin Contact Page, resulting in the disclosure of PII including partner and contact names. id: CVE-2025-27225 info: name: TRUfusion Enterprise = 7.10.4.0 - Admin Conta...

Red Hat JBoss Enterprise Application Platform - Sensitive Information Disclosure

Red Hat JBoss Enterprise Application Platform 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 is susceptible to sensitive information disclosure. A remote attacker can obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true...

TOTVS Fluig <= 1.7.0 - Arbitrary File Read

TOTVS Fluig platform contains a path traversal caused by base64-encoded manipulation of the 'file' parameter, letting attackers access arbitrary files, exploit requires attacker to control the 'file' parameter. id: CVE-2020-29134 info: name: TOTVS Fluig = 1.7.0 - Arbitrary File Read author: ls4ss...