activemq-ids-ips-lab

IDS/IPS 实验室 - 保护 Apache ActiveMQ 免受 RCE 攻击 本项目评估了 IDS 和 IPS 机制如何在受控实验室环境中检测和阻止 Apache ActiveMQ 漏洞 CVE-2023-46604 的利用。 项目概述 该实验室采用攻击者、网关和受害者系统相互分离的设计，以模拟真实的攻防流程。项目包括漏洞发现、手动验证、利用与缓解。 我的工作 构建并测试了实验室环境 使用 GVM 和 Nmap 对目标进行扫描 使用 Metasploit 模拟攻击 使用 Snort IDS/IPS 实现检测 使用 iptables 和 UFW 应用预防控制...

mtechweek_04

mtechweek04 격리된 Metasploitable2 랩 VM에서 수행한 Metasploit 기반 침투 테스트 — DistCCCVE-2004-2687를 통한 원격 공격, udev netlinkCVE-2009-1185를 통한 권한 상승, vsftpd 2.3.4 백도어 분석CVE-2011-2523, 그리고 방화벽 완화 조치의 종단 간 검증을 포함합니다. 이 저장소는 사설 회사 서버를 시뮬레이션한 격리된 QEMU 랩에서 Metasploitable2를 대상으로 수행된 인가된 침투 테스트를 문서화합니다. 이 작업은 Metasploi...

legacyshield-CVE-2017-0144

LegacyShield — EternalBlue 모듈 아직 CVE-2017-0144 MS17-010 / EternalBlue에 노출된 시스템일반적으로 공식 Microsoft 보안 업데이트를 더 이상 받을 수 없는 레거시 또는 지원되지 않는 Windows 설치을 위한 방어적 보완 제어 를 제공하는 Windows 데스크톱 보안 애플리케이션입니다. LegacyShield는 기본 SMBv1 취약점을 패치하지 않습니다. 모니터링, 휴리스틱 탐지, 자동화된 일시적, 되돌릴 수 있는 방화벽 완화, 구조화된 로깅, 전문적인 보고를 통해 공격...

CVE-2026-16531

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service. Mitigation To mitigate this issue, restrict network access to TC...

CVE-2026-34232

A flaw was found in Firebird, an open-source relational database management system. The xdrstatusvector function, responsible for decoding server responses, does not properly handle a specific data type iscargcstring within an opresponse packet. An unauthenticated attacker can exploit this...

CVE-2026-35092

A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol UDP packets. This can cause the service to crash, leading to a denial of service. This vulnerability...

CVE-2026-33250

Freeciv21 is a free open source, turn-based, empire-building strategy game. Versions prior to 3.1.1 crash with a stack overflow when receiving specially-crafted packets. A remote attacker can use this to take down any public server. A malicious server can use this to crash the game on the player'...

CVE-2026-33231

A flaw was found in NLTK Natural Language Toolkit, specifically in the nltk.app.wordnetapp component. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted GET request to the local WordNet Browser HTTP server when it is running in its default...

CVE-2026-27623

A flaw was found in Valkey. A malicious actor with network access to Valkey can cause the system to shut down by sending a specially crafted request. This occurs because the system does not properly reset its networking state after processing an empty request, leading to an assertion failure. Thi...

CVE-2026-26025 free5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.USAR=1 and UsageReport omits mandatory URRID sub-IE 

free5GC SMF provides Session Management Function for free5GC, an open-source project for 5th generation 5G mobile core networks. In versions up to and including 1.4.1, SMF panics and terminates when processing a malformed PFCP SessionReportRequest on the PFCP UDP/8805 interface. No known upstrea...

PT-2026-21588

Name of the Vulnerable Software and Affected Versions free5GC SMF versions prior to 1.4.2 Description The free5GC Session Management Function SMF, a component of the free5GC 5G mobile core network, is susceptible to a panic and process termination. This occurs due to a nil pointer dereference...

CVE-2025-64097

NervesHub is a web service that allows users to manage over-the-air OTA firmware updates of devices in the field. A vulnerability present starting in version 1.0.0 and prior to version 2.3.0 allowed attackers to brute-force user API tokens due to the predictable format of previously issued tokens...

CVE-2025-64097

NervesHub (OTA firmware management service) is affected by CVE-2025-64097 due to tokens used for user/API authentication having a predictable format from 1.0.0 up to 2.3.0. The root cause is insufficient entropy in tokens, allowing brute-forcing to gain unauthorized access to user accounts or API...

CVE-2026-23837 MyTube has an Authorization Bypass vulnerability

MyTube is a self-hosted downloader and player for several video websites. A vulnerability present in version 1.7.65 and poetntially earlier versions allows unauthenticated users to bypass the mandatory authentication check in the roleBasedAuthMiddleware. By simply not providing an authentication...

PT-2026-3495

Name of the Vulnerable Software and Affected Versions MyTube versions prior to 1.7.66 Description MyTube is a self-hosted downloader and player for several video websites. A flaw allows unauthenticated users to bypass the authentication check in the roleBasedAuthMiddleware. By not providing an...

CVE-2025-69217

A flaw was found in coturn. A remote attacker can exploit a predictable random number generator used for nonces and port randomization. By sending a series of unauthenticated requests, an attacker can reconstruct the random number generator's state, allowing them to predict future nonces and port...

CVE-2025-68615

A flaw was found in net-snmp. A remote attacker can trigger a buffer overflow in the snmptrapd daemon by sending a specially crafted SNMP packet, causing the daemon to crash and resulting in a denial of service. Mitigation Make sure to restrict network traffic to the snmptrapd daemon using firewa...

Path traversal in Import Arc data archive functionality in Guardian/CMC before 25.5.0

Summary A path traversal vulnerability was discovered in the Import Arc data archive functionality due to insufficient validation of the input file. Impact An authenticated user with limited privileges, by uploading a specifically-crafted Arc data archive, can potentially write arbitrary files in...

CVE-2025-68435

Zerobyte is a backup automation tool Zerobyte versions prior to 0.18.5 and 0.19.0 contain an authentication bypass vulnerability where authentication middleware is not properly applied to API endpoints. This results in certain API endpoints being accessible without valid session credentials. This...

Authenticated SQL Injection on Alert functionality in Guardian/CMC before 25.2.0

Summary A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. Impact An authenticated user with limited privileges can execute arbitrary SQL statements on the DBMS used by the web application, potentially exposing unauthorized...