nginx-mitigate-log4shell

nginx-mitigate-log4shell 使用Nginx LUA脚本防御log4shell（CVE-2021-44228和CVE-2021-45046）漏洞攻击 需要启用Nginx lua模块（https://www.nginx.com/resources/wiki/modules/lua/）。 在server ...上下文中使用include /path/to/mitigate-log4shell.conf;。可以包含在多个server上下文中。 也可以放在http ...上下文中，因此会自动应用于每个Nginx配置。...

FuguHub-8.4-Authenticated-RCE-CVE-2024-27697

FuguHub 8.4 认证远程代码执行 Fuguhub 是一款云媒体服务器软件。测试的版本是Debian版本，链接如下： https://fuguhub.com/articles/FuguHub-for-Debian Real Time Logic LLC 的 FuguHub v.8.4 存在一个问题，允许本地攻击者通过向管理员面板的“关于”页面发送特制脚本来执行任意代码。 显示FuguHub下载页面的截图 安装步骤： wget FuguHub.com/install/FuguHub.linux.install chmod +x FuguHub.linux.install sudo...

CVE-2022-37932

HP 交换机固件认证绕过漏洞 CVE-2022-37932 固件版本：PD.02.21 受影响的设备：HP 1920系列智能托管交换机 概述 本仓库记录了运行固件版本 PD.02.21 的 HP 1920 系列智能托管交换机中的一个关键认证绕过漏洞。该漏洞允许未经认证的攻击者在无需事先认证的情况下更改管理员密码，从而完全接管设备。 技术细节 该漏洞存在于 /login/defaultpasswordcfg.lua 脚本中，该脚本负责处理设备的默认密码更改。此脚本： 1. 接受表单 POST 请求，但不检查用户是否已认证 2. 仅验证 oldPwd 参数是否与默认密码（为空/空值）匹配 3...

CVE-2020-13151

CVE-2020-13151 POC Aerospike Database 5.1.0.3 主机命令执行 完整文章 @ https://b4ny4n.github.io/network-pentest/2020/08/01/cve-2020-13151-poc-aerospike.html poc.lua 展示了对服务器的手动利用 cve2020-13151.py 用于自动化利用 run-poc.sh 设置 Docker 环境用于本地实验...

CVE-2025-67733

RESP协议注入概念验证 演示通过Valkey/Redis中的Lua脚本错误消息进行的RESP协议注入漏洞的概念验证。 文件 backend.py Flask后端模拟一个使用共享Valkey连接（连接池）的Web应用程序。 端点： 方法| 端点| 描述 ---|---|--- POST| /api/user/role| 设置用户角色 GET| /api/user/role| 获取用户角色 POST| /api/process| 执行Lua脚本 用法： python backend.py password 示例 python backend.py 127.0.0.1 6379 python...

CVE-2025-49844

CVE-2025-49844 原始 uv POC: https://github.com/saneki/cve-2025-49844 提供反向Shell 的PoC。 开始之前 pip3 install -r requirements.txt 帮助 python3 CVE-2025-49844.py -h usage: CVE-2025-49844.py -h -H HOST -P PORT -a PASSWORD -l HOST -p PORT CVE-2025-49844 proof-of-concept — Redis 8.2.1 Lua UAF RCE reverse shell...

protectimus-slim-proxmark3

Script Lua de Proxmark3 para Protectimus SLIM NFC Este script Lua para la plataforma RFID Proxmark3 permite interactuar con el token de hardware de contraseña de un solo uso basada en el tiempo TOTP Protectimus SLIM NFC. Requisitos de hardware Proxmark3 Requisitos de software RRG / Iceman -...

CVE-2025-49844_POC

CVE-2025-49844POC POC de CVE-2025-49844 -h ver información de ayuda ··· Redis presenta una vulnerabilidad de ejecución remota de código en scripts Lua CVE-2025-49844. La causa principal de esta vulnerabilidad es un defecto de diseño en la interacción entre el motor de scripts Lua de Redis y la...

Linux Distros Unpatched Vulnerability : CVE-2026-102875

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives...

AlmaLinux 9.2 [TuxCare] Security Update: redis / redis-devel / redis-doc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1752089153)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1752089153 advisory. - Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflo...

Rocky Linux 9 [CIQ] Security Update: redis / redis-debuginfo / redis-debugsource / redis-devel / etc Multiple Vulnerabilities (crlsa-2022_8096)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20228096 advisory. redis: Code injection via Lua script execution environment CVE-2022-24735 redis: Malformed Lua script can crash Redis CVE-2022-24736 Tenable has extracted...

AlmaLinux 9.2 [TuxCare] Security Update: redis / redis-devel / redis-doc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1762785221)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1762785221 advisory. - Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a...

CVE-2026-102875

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code...

DEBIAN-CVE-2026-102875

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code...

CVE-2026-102875 VLC media player before 3.0.24 Path Traversal via skins2

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code...

EUVD-2026-89410

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code...

CVE-2026-102875

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code...

CVE-2026-102875: Improper Limitation of a Pathname to a Restricted Directory

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: httpd (UTSA-2023-003821)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003821 advisory. In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody0 may cause a denial of service due to no default limit on possib...

CVE-2026-53713 Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, toabsolutenormalizedpath in internal/gatewayapi/luavalidator/security.lua does not collapse redundant separators before iscriticalpath evaluates Lua...