NUUO Camera <=20250203 - OS Command Injection

NUUO Camera up to 20250203 contains a command injection caused by manipulation of the 'log' argument in /handleconfig.php, letting remote attackers execute arbitrary commands, exploit requires remote access. id: CVE-2025-1338 info: name: NUUO Camera =20250203 - OS Command Injection author: Ark...

GitLab CI Lint API - Server-Side Request Forgery

GitLab 10.5 and later contain a server-side request forgery caused by insecure handling of webhook requests, letting unauthenticated attackers exploit the server for arbitrary requests, exploit requires sending crafted webhook requests. id: CVE-2021-22175 info: name: GitLab CI Lint API -...

Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)

Microsoft Exchange Server contains a remote code execution caused by improper input validation in the server component, letting remote attackers execute arbitrary code, exploit requires network access to the server. id: CVE-2021-28481 info: name: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass...

TOTOLINK EX1200T 4.1.2cu.5215 - Authentication Bypass

TOTOLINK EX1200T 4.1.2cu.5215 is susceptible to authentication bypass. An attacker can bypass login by sending a specific request through formLoginAuth.htm, thus potentially being able to obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2021-42887 info:...

Lantronix PremierWave 2050 8.9.0.0R4 - Remote Command Injection

Lantronix PremierWave 2050 8.9.0.0R4 contains an OS command injection vulnerability. A specially-crafted HTTP request can lead to command in the Web Manager Wireless Network Scanner. An attacker can make an authenticated HTTP request to trigger this vulnerability. id: CVE-2021-21881 info: name:...

Oracle E-Business Suite - Blind SSRF

Oracle E-Business Suite, Application Management Pack component User Monitoring subcomponent, is susceptible to blind server-side request forgery. An attacker with network access via HTTP can gain read access to a subset of data, connect to internal services like HTTP-enabled databases, or perform...

Juniper J-Web - Remote Code Execution

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to control certain environments variables to execute remote commands id: CVE-2023-36845 info: name: Juniper J-Web - Remote Code...

SAP BusinessObjects Business Intelligence Platform - Blind Server-Side Request Forgery

SAP BusinessObjects Business Intelligence Platform Web Services 410, 420, and 430 is susceptible to blind server-side request forgery. An attacker can inject arbitrary values as CMS parameters to perform lookups on the internal network, which is otherwise not accessible externally. On successful...

NETGEAR - Authentication Bypass

NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers are vulnerable to authentication bypass vulnerabilities which could allow network-adjacent attackers to bypass authentication on affected installations. id:...

Oracle Weblogic - Server-Side Request Forgery

An unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 allows remote attackers to affect confidentiality via vectors related to WLS - Web Services. id: CVE-2014-4210 info: name: Oracle Weblogic - Server-Side Request Forgery author:...

Oracle WebLogic Server - Remote Code Execution

Oracle WebLogic Server 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 contains a remote code execution caused by unauthenticated access via T3, IIOP, letting attackers take over the server, exploit requires network access. id: CVE-2021-2135 info: name: Oracle WebLogic Server - Remote Code Execution author:...

CHN-Server

CHN-Server Community Honey Network server Find the documentation here: https://communityhoneynetwork.readthedocs.io...

mass-bruter

Mass Bruter Mass bruteforce network protocols Info Simple POC to quickly mass bruteforce common services in a large scale of network. It will check for default credentials on ftp, ssh, mysql, mssql...etc. This was made for authorized penetration testing purpose only. How it works 1. Use...

mass-bruter

Mass Bruter 네트워크 프로토콜 대량 브루트포스 정보 대규모 네트워크에서 일반적인 서비스들을 빠르게 대량 브루트포스하는 간단한 PoC입니다. ftp, ssh, mysql, mssql 등에서 기본 자격 증명을 확인합니다. 이 도구는 승인된 침투 테스트 목적으로만 제작되었습니다. 작동 방식 1. masscannmap보다 빠름을 사용하여 네트워크 세그먼트에서 일반적인 포트가 열린 활성 호스트를 찾습니다. 2. masscan 결과에서 IP와 포트를 파싱합니다. 3. hydra 명령을 구성 및 실행하여 장치에서 지원되는 네트워크...

flightsim

네트워크 비행 시뮬레이터 flightsim 은 보안 팀이 보안 통제 및 네트워크 가시성을 평가할 수 있도록 악성 네트워크 트래픽을 생성하는 경량 유틸리티입니다. 이 도구는 DNS 터널링, DGA 트래픽, 알려진 활성 C2 대상으로의 요청 및 기타 의심스러운 트래픽 패턴을 시뮬레이션하는 테스트를 수행합니다. 설치 GitHub Releases 페이지에서 OS에 맞는 최신 flightsim 바이너리를 다운로드하세요. 또는 Golang을 사용하여 모든 환경예: Linux, MacOS, Windows에서 다음과 같이 유틸리티를 빌드할 ...

HeartBleed

HeartBleed vulnerability in docker 1. git clone https://github.com/Saymeis/HeartBleed.git 2. cd HeartBleed 3. sudo docker build -t heartbleed -f Dockerfile . 4. sudo docker run -p 80:80 -p 443:443 -d heartbleed...

CLEANSTART-2026-MW74031 Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network

Security vulnerability affects the apache-hive package. Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network...

CLEANSTART-2026-IL67419 Netty is an asynchronous, event-driven network application framework

CVE-2026-42580 affects multiple packages. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details...

CLEANSTART-2026-NR95500 Netty is an asynchronous, event-driven network application framework

CVE-2026-42581 affects multiple packages. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details...

zeek-strrat-detector

Zeek 기반 STRRAT 악성코드 탐지기 Zeek Spicy 기반 STRRAT 악성코드 탐지기입니다. PCAP https://app.any.run/tasks/4423258f-59bc-4a88-bfec-d8ac08c88538/ 예제 출력 % zeek -Cr strrat-4423258f-59bc-4a88-bfec-d8ac08c88538.pcap zeek-strrat-detector % cat notice.log separator \x09 setseparator , emptyfield empty unsetfield - path...