android-hardware-attestation-demo

Bypass dell'attestazione hardware Android — demo Questo repository accompagna un articolo di Quarkslab sull'attestazione delle chiavi hardware Android e serve a illustrarla. È una piccola prova di concetto end-to-end che mostra un semplice bypass: un analista su un telefono rooted supera il...

CVE-2026-80520 ovpn: fix NULL dereference when killing missing key

CVE-2026-80520 affects the Linux kernel's OVPN (in-kernel OpenVPN) module. The function ovpn_crypto_kill_key assumes both crypto slots are populated and dereferences each slot before checking for NULL. However, a peer can have only one installed key, and the key-kill path may be asked to remove a...

kas Persistently Disables SSH Host Key Checking

Summary kas persistently disables SSH host key checking for the invoking user when internal SSH key setup is triggered via SSHPRIVATEKEY or SSHPRIVATEKEYFILE and no user-specific SSH configuration file exists so far. When this path is used, kas creates /.ssh/config with a global Host rule...

CVE-2026-54548 kas: Persistent SSH Host Key Checking Disablement

kas is a setup tool for bitbake-based projects. Prior to version 5.4 , when internal SSH key setup is triggered via SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE and no user-specific SSH configuration exists, the function ssh_no_host_key_check() in kas/libcmds.py creates ~/.ssh/config with a global Hos...

CVE-2026-12587 Embedded credentials in Virtuagym

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...

CVE-2026-12587 Embedded credentials in Virtuagym

CVE-2026-12587 affects the Virtuagym application, where a static, hard-coded badge_number parameter is used as the HMAC private key for generating physical access QR codes. This value is exposed via the API endpoint /club/_id_club_/member/_id_member_/resamania_qr_info, and the cryptographic logic...

EUVD-2026-66418

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...

CVE-2020-11651

CVE-2020-11651 PoC per CVE-2020-11651 Richiede Python3 testato su 3.8 python3.8 -m pip install pyzmq msgpack root@kitploit: ⇒ python3.8 poc.py -h usage: poc.py -h -p PORT -c CMD -k -m -r READ -w WRITE -f FILE server server ... Exploit CVE-2020-11651 positional arguments: server Target Server IP o...

CVE-2018-0114-Exploit

CVE-2018-0114-Exploit Una vulnerabilità nella libreria open source node-jose di Cisco, precedente alla versione 0.11.0, potrebbe consentire a un attaccante remoto non autenticato di ri-firmare token utilizzando una chiave incorporata nel token. La vulnerabilità è dovuta al fatto che node-jose seg...

cve-2022-30190

cve-2022-30190 Correzione di CVE-2022-30190 tramite rimozione di ms-msdt dal registro di Windows Risorse Guida e soluzione alternativa di Microsoft Valutazione di Palo Alto...

CVE-2022-40769

CVE-2022-40769 profanity fino alla versione 1.60 ha solo quattro miliardi di possibili inizializzazioni RNG. Pertanto, gli attaccanti possono recuperare le chiavi private dagli indirizzi vanity di Ethereum e rubare criptovaluta, come sfruttato in the wild a giugno 2022. autenticazione| complessit...

CVE_2021_27850_POC

Utilizzo dei comandi root@kitploit: git clone https://github.com/Ovi3/CVE202127850POC.git cd CVE202127850POC/ gradlew runnbaleJar java -jar ./build/libs/CVE202127850POC-1.0-SNAPSHOT.jar Usage: java TapestryExploit Tapestry Key DNS URL java TapestryExploit Tapestry Key CB2 Command Supponendo che l...

CVE-2024-45337-POC

CVE-2024-45337-POC Proof of Concept POC für CVE-2024-45337 Build root@kitploit: go version go version go1.23.2 linux/amd64 go build Verwendung root@kitploit: Usage of ./CVE-2024-45337-POC: -addr string Address of ssh server default "127.0.0.1:2222" -authorised-pubkey string The allowed pubkey tha...

VULNERABLE-CVE-2024-45337

VULNERABLE-CVE-2024-45337 Un progetto di esempio che mostra codice golang vulnerabile a CVE-2024-45337. Questo è un progetto complementare a: https://github.com/NHAS/CVE-2024-45337-POC Così hai qualcosa da sfruttare. Utilizzo root@kitploit: go run solver.go -authorised-pubkey ided25519.pub -allow...

EUVD-2026-66404

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalate privileges on the device...

CVE-2026-77557

CVE-2026-77557 is a critical (CVSS 9.8) Improper Access Control vulnerability in UniFi Protect AI Key . A malicious actor with network access can exploit it to escalate privileges on the device, with no prior authentication required (PR:N). The attack vector is network-based with low complexity, ...

CVE-2026-80204 Grav before 1.0.18 Authentication Bypass via Scoped API Key

The Grav API plugin getgrav/grav-plugin-api before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin/hasPermission...

CVE-2026-80204 Grav before 1.0.18 Authentication Bypass via Scoped API Key

CVE-2026-80204 affects the Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 . The root cause lies in the injectSecurityTab() function of BlueprintController, which performs raw isSuperAdmin()/hasPermission() checks without a request parameter, preventing enforcement of scopeAllows(). As a ...

EUVD-2026-66395

The Grav API plugin getgrav/grav-plugin-api before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin/hasPermission...

CVE-2026-80203 Grav before 1.0.18 Authentication Bypass via Scoped API Key

The getgrav/grav-plugin-api plugin before 1.0.18 contains an authentication bypass in the requireNotSuperTarget() function within UsersControllers.php, affecting seven sensitive user-management endpoints. The root cause is that the scope check calls isSuperAdmin() on the acting account rather tha...