CVE-2023-28432

Explotación de vulnerabilidad en MinIO CVE-2023-28432 Descripción Este script en python3 está diseñado para explotar CVE-2023-28432, que potencialmente afecta a ciertas configuraciones del servidor MinIO. El script realiza una solicitud POST a un hostname especificado, intentando recuperar...

Vendure - Arbitrary File Read

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

CVE-2026-101043: Insertion of Sensitive Information Into Sent Data

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand $VAR environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the...

CVE-2014-6271_pwnable

CVE-2014-6271 CVE-2014-6271 es una vulnerabilidad grave conocida como "Shellshock", descubierta y divulgada en 2014. Esta vulnerabilidad se encontró en el shell Bash y afecta a casi todos los sistemas Unix y Linux, siendo una de las vulnerabilidades más conocidas en Internet. Amenaza de seguridad...

CVE-2009-5147

CVE-2009-5147 y CVE-2015-7551 PoC para ejecutarlo: make foo export FOO=./foo.so ruby -v foo.rb con diferentes versiones de ruby deberías obtener resultados diferentes: vpereira@kimura:/poc rvm use 2.1.7 vpereira@kimura:/poc ruby -v foo.rb ruby 2.1.7p400 2015-08-18 revision 51632 x8664-linux some...

CVE-2021-41277

CVE-2021-41277 Uso 1. mostrar información de ayuda /CVE-2021-41277 ❯ go run main.go -h Usage of main: -f string File containing list of targets to verfity -o string File to write output to optional -s Show VulnInfo output -t int Number of concurrent goroutines for resolving default 10 -u string...

CVE-2026-35585-poc

CVE-2026-35585: PoC de Inyección de Comandos del Sistema Operativo en File Browser English version Resumen Este repositorio es una Prueba de Concepto PoC de la grave vulnerabilidad de inyección de comandos del sistema operativo CVE-2026-35585 encontrada en File Browser versiones 2.0.0 a 2.33.1...

Malicious code in tego-managed-agents-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72c8a01de8d706d83a4b80b845099c11602ba778a392337cad2d9a8a40090b5d The package's custom install command serializes the entire process environment dictos.environ to JSON and POSTs it to the hardcoded endpoint...

MAL-2026-17183 Malicious code in tego-managed-agents-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72c8a01de8d706d83a4b80b845099c11602ba778a392337cad2d9a8a40090b5d The package's custom install command serializes the entire process environment dictos.environ to JSON and POSTs it to the hardcoded endpoint...

dumpscan

Public development on this tool has been paused but is still being worked on privately. Expect a massive update Q3/Q4 2024. Dumpscan is a command-line tool designed to extract and dump secrets from kernel and Windows Minidump formats. Kernel-dump parsing is provided by volatility3. Features x509...

OwnCloud - Phpinfo Configuration

An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information...

Joomla-3.10.12-languagehelper-hotfix

THIS REPO IS OBSOLETE AND YOU SHOULD USE THIS ONE INSTEAD: https://github.com/TLWebdesign/Joomla-3-EOL-Security-Fixes Joomla-3.10.12 LanguageHelper.php Hotfix This little plugin will help you update the LanguageHelper file with the security fix i backported from Joomla 4.4.1 More info on the...

ansible-bashpocalypse

Parche para CVE-2014-6271 https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/ Uso instala ansible en tu equipo local. agrega los servidores que deseas parchear al inventario. ejecuta ansible-playbook ./deploy.yml -i inventory...

EUVD-2026-39807

Podman: Malformed Image can trick podman run into leaking host environment variables into the container...

Ashwesker-CVE-2026-24061

🚨 CVE-2026-24061 : Critical Remote Authentication Bypass in GNU InetUtils telnetd 🧠 Overview CVE-2026-24061 is a critical vulnerability affecting the telnetd service in GNU InetUtils. It allows an unauthenticated remote attacker to log in as root by exploiting improper handling of environment...

CVE-2026-81552

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environment variables...

CVE-2024-37081

VMware vCenter - CVE-2024-37081 Proof of Concept Description This repository contains a proof of concept PoC for the vulnerability CVE-2024-37081 in VMware vCenter. The vulnerability is due to a misconfiguration in the /etc/sudoers file that allows the preservation of dangerous environment...

CVE-2026-81552 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environment variables...

EUVD-2026-85912

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environment variables...

CVE-2026-81552

IBM DataStage on Cloud Pak for Data version 5.4.0.0 is vulnerable to a flaw that could allow a remote authenticated attacker to execute arbitrary commands . The root cause is identified as the improper neutralization of environment variables . This vulnerability carries a High base severity (CVSS...