CVE-2021-27651

CVE-2021-27651 Pega Infinity 密码重置 视频 关注 Youtube Twitter Telegram Vulnmachines.com...

CVE-2021-27651

摘要 攻击者可以绕过密码重置流程的所有步骤，重置Pega Infinity上任意用户的账户。具体方法是：1 启动密码重置流程并输入目标邮箱，然后2 强制通过HTTP POST请求更新密码。攻击者可以使用新编辑的账户登录，并通过多种可接受的认证后代码执行向量（修改动态页面、模板等）完全控制Pega实例。 复现步骤 1. 访问任意Pega实例的登录页面 2. 点击"重置密码" 3. 输入"[email protected]"，代理HTTP请求，将带有"[email protected]"的HTTP请求发送到Burp...

Pega Infinity - Authentication Bypass

Pega Infinity versions 8.2.1 through 8.5.2 contain an authentication bypass vulnerability because the password reset functionality for local accounts can be used to bypass local authentication checks. id: CVE-2021-27651 info: name: Pega Infinity - Authentication Bypass author: idealphase,daffainf...

bedaisy-bypass

bedaisy-bypass 描述 bedaisy-bypass 是一个内核驱动程序，旨在绕过从 BEDaisy.sys 发送到 BEService.exe 的报告。对于不使用 UEFI 的用户，该项目利用 Infinity Hook。该驱动程序拦截通过两个服务之间的命名管道通信的数据。收到请求后，驱动程序检查请求类型，解密返回的数据，并相应地处理。由于报告缓冲区中缺少预期数据（与主用户模式 shellcode 不同），可以利用此机制来解密、置空并重新加密数据。这确保不会有报告发送回服务，同时仍然允许传输响应。 安装 1. 从此仓库下载 Infinity Hook。 2. 将...

research

研究 — Bertoldi 网络安全 由 Alessandro Bertoldi 及其合作者发布的安全研究。 论文 标题| 会议/事件| 年份| 链接 ---|---|---|--- 大规模无限日：劫持注册商、攻破2FA并伪造17,000+域名| DeepSec Vienna 2025| 2025| PDF 作者 大规模无限日（DeepSec Vienna 2025） 主要作者：Alessandro Bertoldi 贡献者：Enrico Bertoldi, Simon Pietro Romano, Emanuele Galdi, Giovanni Minotti 联系方式...

CVE-2026-103110

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprivileged user on a Pexip Infinity Conferencing Node...

CVE-2026-103109

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger memory corruption or a software abort resulting in a denial of service. A crafted media stream may result in a controlled abort durin...

CVE-2026-103102

Pexip Infinity before 41.0 is affected by improper input validation in the signaling implementation which allows a remote attacker to trigger a software abort resulting in a denial of service. Exploitation of this issue requires accessing a gateway call from a WebRTC/API client...

CVE-2026-103104

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation which allows a remote attacker to trigger a software abort resulting in a denial of service...

CVE-2026-103108

Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger a software abort resulting in a denial of service...

CVE-2026-103101

Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to render a Pexip Infinity node inaccessible...

CVE-2026-103105

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attacker with local access to a node within a Pexip Infinity installation to execute arbitrary code as an unprivileged user on another Pexip Infinity node...

CVE-2026-103106

Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation within an internal Pexip Infinity service that allows an attacker with local access to escalate privileges to root. Exploitation requires an attacker to be able to run arbitrary code on a node by eithe...

CVE-2026-103100

Pexip Infinity before 40.1 is affected by improper input validation in the signaling implementation that allows a malicious attacker to trigger a software abort resulting in a denial of service...

CVE-2026-103099

Pexip Infinity before 41.1 is affected by improper input validation in the media implementation that allows a remote attacker to trigger a software abort resulting in a denial of service...

CVE-2026-103110

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprivileged user on a Pexip Infinity Conferencing Node...

CVE-2026-103110

Pexip Infinity is affected by an improper input validation vulnerability in the Conferencing Node. This flaw allows a remote attacker to achieve remote code execution (RCE) as an unprivileged user . The affected versions include those before 38.2 , as well as versions 39.0, 39.1, and 40.0 . No sp...

EUVD-2026-89587

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprivileged user on a Pexip Infinity Conferencing Node...

EUVD-2026-89585

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger memory corruption or a software abort resulting in a denial of service. A crafted media stream may result in a controlled abort durin...

CVE-2026-103109

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger memory corruption or a software abort resulting in a denial of service. A crafted media stream may result in a controlled abort durin...