Kernel-Arbitrary-Read-Vulnerability-Superfetch-EOP

Kernel-Arbitrary-Read-Vulnerability-Superfetch-EOP https://starlabs.sg/blog/2022/06-trying-to-exploit-a-windows-kernel-arbitrary-read-vulnerability/ 의 reacher를 기반으로 한 커널 임의 읽기 취약점 + Superfetch EOP. Exploit은 낮은 무결성low integrity에서 실행해야 합니다...

CVE-2025-69821-Beat-XP-Vega-Smartwatch-Security-Assessment

CVE-2025-69821 : Beat-XP-Vega-Smartwatch-Security-Assessment 对 Beat XP VEGA 智能手表（固件 RB303ATV006229）进行的安全评估，重点关注蓝牙低功耗（BLE）连接，发现了一个设计和实现上的弱点，该弱点使得附近的 BLE 中心设备能够在没有身份验证或会话访问控制的情况下建立并保持唯一可用的 BLE 会话。 该漏洞的概念验证（PoC）已记录在附带的 PDF 中，该 PDF 最初是为相应组织的内部安全审查而提供的。 发现者 : CipherX1802...

CVE-2026-84403 Botslab G980H Dashcams Missing Authentication for Critical Function

The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low Energy communications and GATT characteristics. An unauthenticated attacker within Bluetooth range could intercept or directly retrieve sensitive device...

EUVD-2026-86458

The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low Energy communications and GATT characteristics. An unauthenticated attacker within Bluetooth range could intercept or directly retrieve sensitive device...

CVE-2026-84403

The Botslab G980H dash camera firmware contains a vulnerability where it fails to require authenticated pairing or client binding for Bluetooth Low Energy (BLE) communications and GATT characteristics . This allows an unauthenticated attacker within physical Bluetooth range to intercept or retrie...

CVE-2026-84403 Botslab G980H Dashcams Missing Authentication for Critical Function

The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low Energy communications and GATT characteristics. An unauthenticated attacker within Bluetooth range could intercept or directly retrieve sensitive device...

sweyntooth_bluetooth_low_energy_attacks

SweynTooth - Bluetooth Low Energy를 통한 대혼란 유발 이 저장소는ASSET Research Group의 연구 성과의 일부입니다. SweynTooth는 6개 주요 시스템온칩SoC 벤더의 서로 다른 Bluetooth Low Energy BLE 소프트웨어 개발 키트SDK 전반에 걸친 18개 취약점 군을 포착합니다. 이 취약점들은 특정 BLE SoC 구현의 결함을 드러내며, 무선 범위 내의 공격자가 상황에 따라 교착 상태, 충돌 및 버퍼 오버플로 를 유발하거나 보안 을 완전히 우회 할 수 있게 합니다. 업데...

CVE-2026-51376

Bitchat 1.15.0의 BLE 캐시 포이즈닝 공격 PoC Write up: https://barghest.asia/blog/bitchat-cache-poisoning/ 요구 사항: bleak, pynacl 사용법: python3 barghest.py --scan python3 barghest.py --target...

hui2ochko

이 저장소의 코드는 CVE-2021-43848에 대한 PoC이며 품질이 매우 낮습니다. 어떤 방식으로든 유지 관리할 계획이 없습니다...

portabilis-ieducar-user-type-privilege-escalation

Portabilis i-Educar = 2.1.13 사용자 유형 변경 엔드포인트에 대한 임의 요청을 통한 권한 상승 CVE-2025-11554에 설명된 취약점 악용에 대한 개념 증명으로, i-Educar 소프트웨어에서 사용자 유형 엔드포인트에 대한 임의 요청 중 권한 상승 가능성에 관한 것입니다. 설명 사용자 유형을 변경하는 데 필요한 권한이 없는 사용자도 이 작업을 담당하는 엔드포인트에 대한 임의 요청을 통해 등록된 사용자 유형의 권한을 수정할 수 있습니다. 이를 통해 낮은 권한의 사용자가 자신과 연결된 사용자 유형에 최대...

CVE-2026-20805-POC

CVE-2026-20805 PoC Microsoft의 Desktop Windows Manager dwm.exe 정보 공개 취약점에 대한 개념 증명PoC입니다. 📋 취약점 요약 ID: CVE-2026-20805 제품: Microsoft Windows 구성 요소: Desktop Windows Manager dwm.exe CWE-ID: CWE-200 권한 없는 행위자에게 민감한 정보 노출 심각도 CVSS 3.1: 5.5 보통 벡터: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N 이미 인증된 로컬...

CVE-2026-93662

The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street...

EUVD-2026-85809

The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street...

CVE-2026-84403: Missing Authentication for Critical Function

The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low Energy communications and GATT characteristics. An unauthenticated attacker within Bluetooth range could intercept or directly retrieve sensitive device...

CVE-2026-93662: Exposure of Sensitive Information to an Unauthorized Actor

The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street...

PT-2026-98280

Name of the Vulnerable Software and Affected Versions Botslab G980H affected versions not specified Description The firmware fails to require authenticated pairing or client binding before allowing access to Bluetooth Low Energy communications and GATT characteristics. This allows an...

SUSE CVE-2026-93990

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpair...

CVE-2026-61413

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Improper Privilege Management vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-86683

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings...

CVE-2026-86679

ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope...