EUVD-2026-70207

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. Th...

Vectored-Exception-Handling-Squared

Vectored Exception Handling Squared 一个 Rust 概念验证项目。更多内容请阅读我的博客，所有原创研究来自 CrowdStrike，这里只是它的 POC！ 除非我眼花了；目前似乎没有太多与 CrowdStrike 研究人员的发现相关的资料（如 POC 等）， 该发现被称为 Vectored Exception Handling Squared，即 VEH²。不过我想说，我确实觉得 CrowdStrike 发布这项研究非常酷——我希望看到更多这样的研究！我个人的信条是：进攻带来更好、更深入的防御。 下面是一张用于说明原理的示意图：...

VectoredOverloading

VectoredOverloading Vectored Overloading 是一种本地 PE 注入技术，最早在 KidKadi 恶意软件中被发现。 它通过使用硬件断点（HWBP）和向量化异常处理（VEH）操控合法 DLL 的加载过程，从而动态更改 DLL 段对象。 本质上，该技术执行以下操作： 从合法 DLL（例如 wmp.dll）创建一个 SECIMAGE 映射 将有效载荷 PE 映射到该镜像内存上 将其入口点设置为 0，并在 FileHeader-Characteristics 字段中强制设置 DLL 标志 在 NtOpenSection 上设置 HWBP，然后加载任意合法 D...

struts2_cve-2017-5638

struts2cve-2017-5638 这是一个对 Python 漏洞利用代码的 Java 移植版本，原代码位于：https://www.exploit-db.com/exploits/41570/。 该软件编写为无外部依赖。 免责声明 此工具仅供安全工程师和应用程序安全人员用于安全评估。请负责任地使用此工具。本人不对任何人使用此应用程序的方式承担责任。对于因使用此工具造成的任何损害或引发的任何犯罪，本人概不负责。 漏洞信息 CVE-ID ：CVE-2017-5638 链接 ：https://vulners.com/cve/CVE-2017-5638 描述 ：Apache Struts...

instrumentation_callbacks

instrumentationcallbacks Instrumentation callbacks are quite a fun undocumented part of Windows. All the code in this repository is released under the MIT license. This repository uses google style C++ spacing. PRs are welcome if you find issues, bugs, or believe a specific feature should be adde...

CVE-2024-52316

🚨🚨CVE-2024-52316🚨🚨 🚨🚨CVE-2024-52316 - Apache Tomcat 认证绕过漏洞 概述 CVE-2024-52316 是 Apache Tomcat 中发现的一个认证绕过漏洞。当 Tomcat 配置了自定义的 Jakarta Authentication （前身为 JASPIC）ServerAuthContext 组件时，会出现此问题。如果在认证过程中发生异常，且该组件未显式设置 HTTP 状态码来指示失败，则认证过程可能错误地成功，从而允许攻击者绕过认证。 受影响版本 以下 Apache Tomcat 版本受此漏洞影响： 版本系列| 受影响版本...

ShellGhost

ShellGhost 一种基于内存的规避技术，使 shellcode 从进程开始到结束均不可见。 动机 我想分享这个 shellcode 自注入 POC，以展示一些可能对红队有用的 AV/EDR 规避概念。就在几周前，我想出了一种自定义的内存规避技术，我称之为 ShellGhost。这项技术源于对 一段从进程开始到结束执行‘不可见’ shellcode 的代码 的需求。 处理线程执行流 ShellGhost 依赖于向量异常处理与软件断点的结合 ，以循环方式停止线程执行，用 RC4 加密的 shellcode 指令替换已执行的断点，解密指令，并在恢复内存保护至 RX 后恢复执行。当后续的...

CVE-2026-84200 Kyverno before v1.13.0 Policy Bypass via Multiple Exceptions

Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second...

CVE-2026-82744

ash-project ash (Elixir library) contains a Failing Open vulnerability in Ash.Reactor.ChangeStep (lib/ash/reactor/steps/change_step.ex). When a where guard controlling a change step raises an exception (e.g., on attacker-influenced input), the rescue in apply_validation converts it to {:error, er...

CVE-2026-82744 Ash.Reactor change step fails open, skipping a change when its where guard raises

Not Failing Securely Failing Open vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not. An Ash.Reactor change step can be gated by where validations that decide whether the change runs. Ash.Reactor.ChangeStep...

CVE-2017-5638

CVE-2017-5638 | Struts s2-045 描述 通过恶意构造的Content-Type值，可以执行远程代码执行（RCE）攻击。如果Content-Type值无效，则会抛出异常，随后利用该异常向用户显示错误消息。 受影响版本 Struts 2.3.5 Struts 2.3.31 Struts 2.5 Struts 2.5.10 漏洞利用 修复措施 要修复此问题，请更新受影响软件以应用安全补丁。 Struts 2.3.32或2.5.10.1是已针对此特定问题打补丁的版本。 作者 此利用程序由zc00l ANDRE LUIS .. MARQUES编写；...

Linux Distros Unpatched Vulnerability : CVE-2026-47893

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception...

TamperingSyscalls

TamperingSyscalls TamperingSyscalls es un proyecto novedoso de 2 partes que consiste en el spoofing de argumentos y la obtención de syscalls, los cuales abusan del EH para subvertir los EDR. Este proyecto consta de ambos subproyectos para proporcionar una solución alternativa a las syscalls...

xmlrpc-bruteforcer

An XMLRPC BruteForcer for Wordpress - Inpired by 1N3@CrowdShield Note - This project is discontinued Usage root@kitploit: python3 xmlrcpbruteforce.py http://wordpress.org/xmlrpc.php passwords.txt username python3 xmlrpcbruteforce.py http://wordpress.org/xmlrpc.php passwords.txt userlist.txt in...

moonwalk

moonwalk: ricerca dell'indirizzo base delle DLL Questa libreria Rust e strumento CLI dimostrano un metodo alternativo per trovare l'indirizzo base delle DLL caricate senza utilizzare un attraversamento del Process Environment Block PEB. Questa tecnica è particolarmente utile in scenari in cui...

CVE-2026-47893

A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30...

Apache-Dubbo-Hessian2-CVE-2021-43297

Deserialisierung bei der Apache Dubbo Hessian2-Ausnahmebehandlung CVE-2021-43297 1. Importieren Sie die beiden Projekte jeweils in zwei Idea-Instanzen. 2. Starten Sie zuerst den Server, indem Sie org.apache.dubbo.samples.basic.BasicProvidermain ausführen. 3. Starten Sie dann die...

The vulnerability of the do_secure_storage_access() function in the arch/s390/mm/fault.c module of the S390 platform support module for the Linux operating system allows a attacker to compromise the confidentiality and accessibility of protected information.

The vulnerability of the dosecurestorageaccess function in the arch/s390/mm/fault.c module of the S390 platform support module for the Linux operating system is related to an exception handling error. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and...

The vulnerability of the arch_add_memory() function in the arch/powerpc/mm/mem.c module of the PowerPC platform in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the archaddmemory function in the arch/powerpc/mm/mem.c module of the PowerPC platform in the Linux operating system is related to insufficient handling of exceptional conditions. Exploiting this vulnerability can allow an attacker to cause a service failure...

Vulnerability of functions __ext4_iget() (fs/ext4/inode.c) and swap_inode_boot_loader() (fs/ext4/ioctl.c) in the Ext4 file system of the Linux operating system, which allows a hacker to trigger a service failure

The vulnerability of the ext4iget function fs/ext4/inode.c and the swapinodebootloader function fs/ext4/ioctl.c in the Ext4 file system of the Linux operating system is related to insufficient handling of exceptional conditions. Exploiting this vulnerability can allow an attacker to cause a servi...