CVE-2020-13151

CVE-2020-13151 POC Aerospike Database 5.1.0.3 ホストコマンド実行 詳細な解説 @ https://b4ny4n.github.io/network-pentest/2020/08/01/cve-2020-13151-poc-aerospike.html poc.lua はサーバーへの手動エクスプロイトを示します cve2020-13151.py は自動エクスプロイト用です run-poc.sh はローカル実験用の Docker 環境をセットアップします...

FuguHub-8.4-Authenticated-RCE-CVE-2024-27697

FuguHub 8.4 認証済みRCE FuguHub はクラウドメディアサーバーソフトウェアです。テストしたバージョンは、このリンクの Debian 版です: https://fuguhub.com/articles/FuguHub-for-Debian Real Time Logic LLC の FuguHub v.8.4 には、ローカルの攻撃者が細工したスクリプトを Administrator パネルの About ページに送ることで任意のコードを実行できる問題があります。 FuguHub のダウンロードページを示すスクリーンショット インストール手順: wget...

nginx-mitigate-log4shell

nginx-mitigate-log4shell Mitigate log4shell（CVE-2021-44228およびCVE-2021-45046）脆弱性攻撃をNginx LUAスクリプトを使用して軽減します。 Nginx luaモジュール（https://www.nginx.com/resources/wiki/modules/lua/）が有効になっている必要があります。 server ... コンテキスト内で include /path/to/mitigate-log4shell.conf; を使用します。複数のサーバーコンテキストに含めることができます。 http...

CVE-2022-37932

HP 스위치 펌웨어 인증 우회 취약점 CVE-2022-37932 펌웨어 버전: PD.02.21 영향을 받는 장치: HP 1920 시리즈 스마트 관리형 스위치 개요 이 저장소는 펌웨어 버전 PD.02.21을 실행하는 HP 1920 시리즈 스마트 관리형 스위치의 중요한 인증 우회 취약점을 문서화합니다. 이 취약점을 통해 인증되지 않은 공격자가 사전 인증 없이 관리자 비밀번호를 변경할 수 있어 장치를 완전히 장악할 수 있습니다. 기술 세부 사항 취약점은 장치의 기본 비밀번호 변경을 처리하는...

CVE-2025-49844

CVE-2025-49844 원본 uv POC: https://github.com/saneki/cve-2025-49844 리버스 쉘 을 제공하는 PoC. 시작 전 pip3 install -r requirements.txt 도움말 python3 CVE-2025-49844.py -h usage: CVE-2025-49844.py -h -H HOST -P PORT -a PASSWORD -l HOST -p PORT CVE-2025-49844 proof-of-concept — Redis 8.2.1 Lua UAF RCE reverse she...

protectimus-slim-proxmark3

Protectimus SLIM NFC 用 Proxmark3 Lua スクリプト この Proxmark3 RFID プラットフォーム用 Lua スクリプトは、時間ベースのワンタイムパスワード TOTP ハードウェアトークン Protectimus SLIM NFC と対話することができます。 ハードウェア要件 Proxmark3 ソフトウェア要件 RRG / Iceman - Proxmark3 デモ この概念実証ビデオは、この Lua スクリプトを使用して、脆弱な Protectimus SLIM NFC TOTP トークンに対する「タイムトラベラー攻撃」を例示的に実演しています...

CVE-2025-49844_POC

CVE-2025-49844POC CVE-2025-49844 POC -h ヘルプ情報を表示 ··· Redis にはRedis Luaスクリプトのリモートコード実行の脆弱性CVE-2025-49844が存在します。この脆弱性の根本的な原因は、Redis の Lua スクリプトエンジンとメモリ管理ロジックの相互作用に設計上の欠陥があることです。 ··· ··· 関連URL：https://nvd.nist.gov/vuln/detail/CVE-2025-49844 ··· 免責事項：このスクリプトは許可を得た環境でのみ使用してください。無許可のネットワーク攻撃への使用は禁止されてい...

Wireshark 1.4.x < 1.4.9 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 1.4.9. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.4.9 advisory. - Wireshark 1.6.x before 1.6.2 allows remote attackers to cause a denial of service application crash via...

CVE-2025-67733

RESP プロトコルインジェクション PoC Valkey/Redis の Lua スクリプトエラーメッセージを介した RESP プロトコルインジェクションの脆弱性を実証する概念実証です。 ファイル backend.py 共有 Valkey 接続（コネクションプーリング）を使用する Web アプリケーションを模した Flask バックエンド。 エンドポイント: メソッド| エンドポイント| 説明 ---|---|--- POST| /api/user/role| ユーザーロールを設定 GET| /api/user/role| ユーザーロールを取得 POST| /api/process|...

Rocky Linux 8 [CIQ] Security Update: redis / redis-debuginfo / redis-debugsource / redis-devel / etc Multiple Vulnerabilities (crlsa-2022_7541)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20227541 advisory. redis: Code injection via Lua script execution environment CVE-2022-24735 redis: Malformed Lua script can crash Redis CVE-2022-24736 Tenable has extracted...

Rocky Linux 9 [CIQ] Security Update: redis / redis-debuginfo / redis-debugsource / redis-devel / etc Multiple Vulnerabilities (crlsa-2022_8096)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20228096 advisory. redis: Code injection via Lua script execution environment CVE-2022-24735 redis: Malformed Lua script can crash Redis CVE-2022-24736 Tenable has extracted...

AlmaLinux 9.2 [TuxCare] Security Update: redis / redis-devel / redis-doc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1752089153)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1752089153 advisory. - Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflo...

Linux Distros Unpatched Vulnerability : CVE-2026-102875

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives...

AlmaLinux 9.2 [TuxCare] Security Update: redis / redis-devel / redis-doc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1762785221)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1762785221 advisory. - Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a...

DEBIAN-CVE-2026-102875

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code...

CVE-2026-102875

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code...

UBUNTU-CVE-2026-102875

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code...

CVE-2026-102875

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code...

EUVD-2026-89410

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code...

CVE-2026-102875

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code...