686 matches found
CobaltStrike-BOF
CobaltStrike BOF Collection of beacon BOF. 1 DCOM Lateral Movement A quick PoC that uses DCOM ShellWindows via beacon object files for lateral movement.You can either specify credentials or use the current user. To use the current user, just leave the domain, username, and password empty. A short...
clamtk
Readme for clamtk Note: This program is no longer maintained. https://gitlab.com/davem/clamtk/-/issues/144 This README was last checked or updated on 20240402. Table of contents: 1. About 2. Contributing 3. Installation 4. Usage 5. Plugins 6. Troubleshooting 7. Other 8. Thank you 9. Contact About...
CVE-2025-22241
File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”. The functionality is used to auto-accept Minion authentication keys based on a pre-placed “authorization file” at a specific location a...
CVE-2025-22237
An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url which could cause and arbitrary command to be run on the master with the same privileges as the master process...
CVE-2026-98361
A flaw was found in the Linux kernel's RDMA over Converged Ethernet rxe driver. This flaw allows a local attacker to achieve privilege escalation by overwriting arbitrary read-only files. Missing write permission checks during On-Demand Paging ODP operations allow an unprivileged user to map memo...
Xen Populate on Demand DoS
The vulnerability of the Populate on Demand PoD mechanism in Xen hypervisors lies in the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures...
Oracle Linux 10 : ruby4.0 (ELSA-2026-72427)
The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-72427 advisory. 4.0.6-37 - Fix resolv: do not register on-demand classes for unknown DNS types and SvcParamKeys to prevent memory exhaustion CVE-2026-80212 Resolves:...
CVE-2026-100853
In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly...
CVE-2026-100853 AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass
In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly...
CVE-2026-100853
AzuraCast versions prior to 0.23.8 are vulnerable to an authorization bypass in the public On-Demand download endpoint. The root cause is a failure to verify playlist-level access controls , which allows unauthenticated users to download media files that were intended to be excluded from On-Deman...
EUVD-2026-87835
In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly...
CVE-2026-100853 AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass
In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly...
CVE-2026-100853 AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass
In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly...
CVE-2026-100853: Missing Authorization
In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly...
PT-2026-99473
Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.8 Description The public On-Demand download endpoint fails to verify playlist-level access controls. This allows unauthenticated users to bypass intended access restrictions by directly requesting media via the...
ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7), ai.fastllm:agent-checkpoint-git_3 (>=0.3.0, <=0.5.7) +1190 more potentially affected by CVE-2026-61814 via org.typelevel:jawn-parser_3 (>=1.1.2, <=1.6.0)
org.typelevel:jawn-parser3 MAVEN version =1.1.2, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.4.0 and more Source cves: CVE-2026-61814 Source advisory: OSV:GHSA-W4CM-GVHJ-CGW6...
JLSEC-2026-1365 wasmtime has a panic when allocating a table exceeding the size of the host's address space
Impact Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables ca...
shodan
Shodan API client for Go A small Shodan API client and CLI bu...
