parallels-file-move-privesc

parallels-file-move-privesc This repository contains an exploit for CVE-2023-50226 / ZDI-CAN-21227, which can be used to escalate privileges to root using Parallels Desktop on versions before 18.3.2...

RedCloud-OS

⚠️ RedCloud OS 项目已迁移 🚚 该项目已迁移至新位置：https://github.com/RedCloudOS 👉 访问我们的网站了解更多信息：https://redcloud.training/ 此仓库现已归档，将不再接收更新。...

CVE-2022-43271

CVE-2022-43271 Cross-Site Scripting XSS almacenado Producto: Move CRM https://inhabit.com.au/Move-Real-Estate-CRM-Software Fecha de descubrimiento: 2/8/2022 Fecha de corrección: 4/8/2022 Versión afectada: versión 4, build 260 Versión corregida: versión 4, build 261 Descripción: La vulnerabilidad...

MoveEdr

MoveEDR If you're admin you can force Windows to delete or move folders and files around immediately after booting before services are started. This can be used to disable EDRs. Usage !CAUTION There is an issue with CrowdStrike which results in a bootloop with the message "INACCESSIBLEBOOTDEVICE"...

move-vulnerability-database

¡Bienvenido a la Base de Datos de Vulnerabilidades de Move MVD v3.0! Una colección exhaustiva de patrones de vulnerabilidades en el ecosistema Move. Qué Incluye Patrones de Vulnerabilidad - Problemas de seguridad categorizados con ejemplos y niveles de severidad Apéndice - Informes de auditoría y...

WdToggle

此仓库已迁移至我们的 C2-Tool-Collection 仓库。...

CVE-2019-1315

Windows Error Reporting Manager arbitrary file move Elevation of Privilege Details: https://offsec.almond.consulting/windows-error-reporting-arbitrary-file-move-eop.html You will need the NtApiDotNet library to run it, as well as a valid Report.wer file, both to be placed in the same directory as...

Benchmark

El proyecto OWASP Benchmark en GitHub se ha trasladado. Ahora hay una nueva organización en GitHub para OWASP Benchmark en: https://github.com/OWASP-Benchmark y lo que era https://github.com/OWASP/Benchmark ahora es: https://github.com/OWASP-Benchmark/BenchmarkJava Con el tiempo, se añadirán...

CVE-2020-0668

CVE-2020-0668 Usa CVE-2020-0668 para realizar una operación arbitraria de movimiento de archivos con privilegios. Usa https://github.com/itm4n/UsoDllLoader Windows = 1903 O https://github.com/xct/diaghub Windows 1903 para la escalada de privilegios. Demo Enlaces y Recursos...

CVE-2016-3088

CVE-2016-3088 Apache ActiveMQ Remote Code Execution Exploit Description The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request. Author Alexandre Aguiar @cyberaguiar Exploit...

RazerEoP

RazerEoP PoC para la eliminación/movimiento arbitrario de archivos en el módulo de macros de Razer Synapse 3. Este módulo permite al usuario exportar macros creadas a un archivo en disco, y la operación de archivo se realiza a través del servicio de Razer que se ejecuta como nt authority\system...

CVE-2026-81912

Concrete CMS before 9.5.3 contains a Cross-Site Request Forgery (CSRF) flaw in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm() endpoint moved selected group tree nodes without validating an action token, allowing a state-changing group move to be processed agains...

CVE-2026-81912 Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an...

EUVD-2026-76243

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an...

CVE-2026-81912 Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an...

CVE-2026-27654-PoC

CVE-2026-27654 – PoC del manejo de rutas DAV Alias en el módulo ngxhttpdavmodule de nginx Este repositorio proporciona un exploit de prueba de concepto para CVE‑2026‑27654 , una vulnerabilidad de desbordamiento de montón heap overflow en el módulo ngxhttpdavmodule de nginx. El fallo surge de un...

CVE-2026-64838

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process...

CVE-2026-64838 ICEcoder through 8.1 Path Traversal via oldFileName Parameter

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process...

CVE-2024-21111

CVE-2024-21111 Oracle VirtualBox Prior to 7.0.16 is vulnerable to Local Privilege Escalation via Symbolic Link Following leading to Arbitrary File Delete and Arbitrary File Move. VirtualBox attempts to move log files as NT AUTHORITY\SYSTEM in C:\ProgramData\VirtualBox which all users can write to...

CVE-2026-27654

CVE-2026-27654 NGINX ngxhttpdavmodule Desbordamiento de búfer en el montón mediante subdesbordamiento de sizet Denegación de servicio remota / Potencial ejecución remota de código Descripción ngxhttpdavcopymovehandler en src/http/modules/ngxhttpdavmodule.c calcula la longitud de la URI de destino...