auth

Autenticación de PlaceOS VARIABLES DE ENTORNO If a sentry Data Source Name is configured SENTRYDSN=https://@.ingest.sentry.io/ A shared secret for encrypting cookies SECRETKEYBASE=84b04ea4259542f365 JWT Private key JWTSECRET=Base64 Encoded RSA PRIVATE KEY Database name and host...

CVE-2026-98029

A flaw was found in the Linux kernel's Netronome Flow Processor NFP network driver. The driver fails to validate the user-provided buffer size when retrieving network flow steering rules. An unprivileged local user can exploit this vulnerability to trigger an out-of-bounds memory write or a null...

CVE-2026-98028

A flaw was found in the Linux kernel's Netronome Flow Processor NFP network driver. When replacing an existing flow steering rule fails during hardware reprogramming, the driver fails to remove the old rule from its internal list, creating an inconsistency with the active rule counter. A local us...

lvi-lfb-attack-poc

LVI-LFB控制流劫持攻击（CVE-2020-0551）的PoC 本仓库包含LVI-LFB控制流劫持攻击PoC的源代码。 内容 lvi-cfh-poc - 通过行填充缓冲区喷射劫持另一个进程的控制流 白皮书 前提条件 1. Visual Studio 2015 2. 存在漏洞的Intel CPU 作者 Andrei Vlad LUȚAȘ Dan Horea LUȚAȘ 附加资源...

CVE-2026-93355

LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the emailverified claim...

caracal

Caracal Caracal es una herramienta de análisis estático sobre la representación SIERRA para contratos inteligentes de Starknet. Características Detectores para detectar código Cairo vulnerable Impresoras para reportar información Análisis de taint Marco de análisis de flujo de datos Fácil de...

caracal

Caracal Caracal is a static analyzer tool over the SIERRA representation for Starknet smart contracts. Features Detectors to detect vulnerable Cairo code Printers to report information Taint analysis Data flow analysis framework Easy to run in Scarb projects Installation Precompiled binaries...

androguard

Androguard Do you think your phone has been pwned ? please check IsMyPhonePwned New tool: Goauld Dynamic injection tool for Linux/Android See the new version of Androguard: https://github.com/androguard/androguard/tree/ng Installation Quick installation: root@kitploit: pip install androguard...

CVE-2022-25636

CVE-2022-25636 netfilter内核提权 toc 漏洞简介 漏洞编号: CVE-2022-25636 漏洞产品: linux kernel - netfilter 影响版本: linux kernel 5.4 漏洞危害: netfilter 内核模块中存在堆越界写，存在SYSADMIN时可以造成提权 环境搭建 漏洞存在于netfilter 内核模块中，漏洞所在代码在3个ko 中。 nftdupnetdev.ko nfdupnetdev.ko nftables.ko 直接qemu 启动有问题，ko 装载不上，使用vmware双机联调。 ubuntu 21.10...

CVE-2026-18963

CVE-2026-18963 Keycloak Unauthenticated Account Takeover ★ CVE-2026-18963 Keycloak Reset-Credentials Flow Bypass PoC ★ https://github.com/user-attachments/assets/ebed1e64-a40c-4333-be18-9acbadd655b0 Overview CVE-2026-18963 is a critical unauthenticated account takeover vulnerability in the Keyclo...

cve-2016-7190

概述 CVE-2016-7190 0 是 ChakraCore 中 Array.map 函数的一个堆溢出漏洞，可覆盖相邻内存。获取任意读写权限的主要思路是先分配多个连续的 JavaScript 整数数组，然后利用溢出操控其中一个数组的大小。接着，我们利用这个数组将 Uint8Array 的基地址改为我们想要读写的任意地址。之所以需要这个额外步骤，是因为溢出仅限于被溢出整数数组大小的 2 倍。 由于该漏洞可以轻松地重新引入到当前版本的 ChakraCore 中（参见 undo-cve-2016-7190.patch），因此非常适合测试不同的利用策略。 我的测试环境 ChakraCore...

CVE-2024-0195-SpiderFlow

CVE-2024-0195 Control Inadecuado de Generación de Código 'Inyección de Código' Crítico 2024 Resumen CVE-2024-0195 es una vulnerabilidad crítica de inyección de código en la aplicación web spider-flow 0.4.3, específicamente en la función FunctionService.saveFunction del archivo...

CVE-2023-0264

PoC for CVE-2023-0264 Keycloak vulnerability that allows session hijacking during authorization code flow See https://github.com/advisories/GHSA-9g98-5mj6-f9mv Prerequisites Docker curl jq python3 or another tool to serve static files on HTTP Steps to reproduce 1. Start Keycloak container with...

Argos

Argos — 区块链资产追踪平台 Argos 是一个多语言区块链调查平台，用于在以太坊和比特币上追踪、分析和可视化资金流动。基于 Rust、OCaml 和 TypeScript/React 构建。 架构 +-----------------------+ | Frontend React 19 | | Vite + Tailwind CSS | +-----------+-----------+ | HTTP/REST +-----------v-----------+ | REST API Rust | | Axum — port 8990 | | | | in-process...

http2-bomb-analysis-paper

Bomba HTTP/2: Ataque de cadena de amplificación de referencia indexada HPACK Inmersión técnica independiente de un estudiante de secundaria Junio de 2026 TL;DR Este repositorio contiene mi análisis completo de la vulnerabilidad HTTP/2 Bomb CVE-2026-49975 / CVE-2026-47774, que encadena dos...

polytracker

PolyTracker PolyTracker es una herramienta creada originalmente para la Automated Lexical Annotation and Navigation of Parsers , un backronym ideado únicamente para el propósito de referirse a ella como The ALAN Parsers Project. Sin embargo, ha evolucionado hasta convertirse en una herramienta de...

Musicbox WordPress - Reflected XSS

contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13327 info:...

CVE-2025-50881

CVE-2025-50881: API Use it Flow 中通过 moniteur.php 实现远程代码执行 标识符: CVE-2025-50881 受影响产品: API Use it Flow 版本 8.2.0 Rev 15851, 版本 9.2.0 Rev 18093 编辑者: https://www.tenorsolutions.com 原 https://api-sas.fr/ 受影响组件: flow/admin/moniteur.php 漏洞类型: 通过 eval 注入实现的远程代码执行 RCE 严重性: 严重 描述: flow/admin/moniteur.php...

route-sixty-sink

✏️ Colaboradores Dillon Franke @dillonfranke Michael Maturi @a-marionette 📝 Blog https://www.mandiant.com/resources/route-sixty-sink-launch ⚓ Route Sixty-Sink Route Sixty-Sink es una herramienta de código abierto que permite tanto a defensores como a investigadores de seguridad identificar...

threat-model-cookbook

Proyecto OWASP Threat Model Cookbook Este proyecto consiste en crear y publicar ejemplos de modelos de amenazas. Pueden ser representaciones en forma de código, gráficas o textuales. Los modelos utilizarán diversas tecnologías, metodologías y técnicas. Puedes aprender de estos modelos, usarlos co...