Cisco ISE < 3.4P2 - Unauthenticated Arbitrary File Upload

Cisco ISE and Cisco ISE-PIC contain an unrestricted file upload vulnerability caused by lack of file validation in an internal API, letting unauthenticated remote attackers upload and execute files as root, exploit requires crafted file upload. id: CVE-2025-20282 info: name: Cisco ISE 3.4P2 -...

CVE-2025-8110

CVE-2025-8110 — Gogs = 0.13.3 シンボリックリンクトラバーサルによる任意ファイル書き込み 概要 Gogs = 0.13.3 は、PutContents API /api/v1/repos/:owner/:repo/contents/:path を介した任意ファイル書き込みに対して脆弱です。 API はディレクトリトラバーサルシーケンス ../ に対してファイルパスを検証しますが、書き込み前にシンボリックリンクを解決しません 。認証済みユーザーは、サーバー上の任意のファイルを指すシンボリックリンクを含むコミットをプッシュし、そのシンボリックリンクに対して...

CVE-2025-54322-exploit

CVE-2025-54322: XSpeeder SXZOS 预认证远程代码执行 RCE 利用工具 这是一个针对 CVE-2025-54322 的专业漏洞验证工具 PoC。该漏洞是 XSpeeder SXZOS 固件中存在的一个严重的预认证远程代码执行漏洞，最初由 pwn.ai 的自治 AI 智能体独立发现并披露。 🔍 漏洞概述 CVE 编号 : CVE-2025-54322 CVSS 评分 : 10.0 严重 受影响厂商 : XSpeeder 受影响产品 : SXZOS 固件 SD-WAN / 边缘路由器 漏洞类型 : 对用户输入不安全地使用 eval 函数 权限要求 : 无 预认证...

RootQuest-CTF-Box-Multi-Stage-Exploitation-VM

RootQuest CTF 靶机 — 多阶段漏洞利用虚拟机 💀 Kalaichelvan Thieveshkar CB013248 · 斯塔福德郡大学 · COMP50003 - Cyber Security II 概述 RootQuest 是一个专门构建的 CTF 虚拟机，包含一条 10 阶段 、顺序执行的攻击路径，横跨 5 个安全域 。每个挑战都会产生下一步所需的输出——玩家必须将 Web、加密、网络和本机漏洞利用串联起来，才能实现完整的 root 权限获取。 警告 / 预期用途： 此虚拟机仅用于教育、防御和授权的 CTF 用途。请勿 在生产网络中部署。请在隔离的实验环境中使用。...

PT-2026-89884

Affected versions of Puppet Enterprise contain a command injection vulnerability in the handling of the java keystore passwd parameter. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which ...

blackbox-pentesting-infsecos

黑盒渗透测试 — SecOS:1 VulnHub 概述 针对 SecOS:1 的完整黑盒渗透测试,这是一台来自 VulnHub 的刻意存在漏洞的 CTF 靶机。目标:模拟一名零先验知识的真实攻击者,实现 root 权限接管,并以获取 /root/flag.txt 作为证据。 所有测试均在受控虚拟实验环境Apporto Cloud中进行,作为大学课程模块的一部分。未针对任何真实系统。 实验环境 机器| 角色| IP ---|---|--- Kali Linux saqib85| 攻击机| 192.168.122.186 SecOS:1 InfoSecOS| 主要目标|...

CVE-2020-5902

🚨 CVE-2020-5902 — F5 BIG-IP TMUI リモートコード実行（RCE） CVE-2020-5902 は、F5 BIG-IP の Traffic Management User Interface（TMUI / 設定ユーティリティ）における 重要な未認証リモートコード実行（RCE） 脆弱性です。 📌 概要 F5 により 2020年6月30日 （NVD は2020年7月1日公開）に開示されたこの欠陥により、管理インターフェースにネットワークアクセス可能な未認証の攻撃者 （または認証ユーザー）が、任意のシステムコマンドを実行...

Kioptrix-Level1-Vulnerability-Analysis

Kioptrix Level 1：全光谱漏洞审计与利用 🏛️ 专业目标 目标是对 Kioptrix Level 1 环境执行结构化渗透测试，实现完整的 'root' 权限获取，并记录适用于红队和蓝队操作的技术修复策略。 🏗️ 环境复现（硬件背景） 现代虚拟化默认设置通常在 2010 年的老旧内核上无法正常工作。为了成功启动该机器并使其联网，需要以下特定的架构配置： 操作系统子类型： Linux / Red Hat（32 位）。 存储架构： 从 SATA 切换为 IDE 控制器 ，以支持旧版 .vmdk 硬盘。 网络协议： 配置为 PCI FAST-III ，使用 仅主机适配器 ，以便与...

CVE-2026-79755

CVE-2026-79755 affects Nuclio , a Serverless framework for real-time events and data processing. On the local Docker platform , prior to version 1.17.4 , the function namespace is interpolated unvalidated into a double-quoted docker ps --filter "label=nuclio.io/namespace=" command executed via /b...

GHSA-M2PC-3Q4Q-W6JR reachy_mini Allows Unrestricted Upload of File with Dangerous Type

Summary The Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file validation mechanisms. An attacker can use this endpoint to upload malicious files into the file system that will propagate in future attacks. Compromise Chain: Unauthenticated to Full...

CVE-2026-69108

A vulnerability has been identified in Siemens License Server SLS All versions V5.1. The affected application is vulnerable to a local privilege escalation due to an insecure sudoers policy. This could allow an attacker to execute arbitrary commands and plant malicious files as root, leading to...

PT-2026-69150

Name of the Vulnerable Software and Affected Versions Kata Containers versions prior to 4.0.0 Description The kata-runtime allows host code execution due to an unvalidated configuration path annotation. The runtime accepts an arbitrary io.katacontainers.config path pod annotation and loads the...

OESA-2026-3031 cifs-utils security update

The in-kernel CIFS filesystem is generally the preferred method for mounting SMB/CIFS shares on Linux. Security Fixes: A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in...

ALSA-2026:26533 Important: dracut security update

The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition...

DEBIAN-CVE-2026-48693

FastNetMon Community Edition through 1.2.9 is vulnerable to a local symlink attack via predictable file paths in /tmp. The statistics file path defaults to '/tmp/fastnetmon.dat' src/fastnetmon.cpp line 159. The printscreencontentsintofile function src/fastnetmonlogic.cpp line 2186 opens this path...

Fedora 43 : PackageKit (2026-7463cd3c32)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7463cd3c32 advisory. Backport fix for race condition leading to root compromise GHSA-f55j-vvr9-69xv Tenable has extracted the preceding description block directly from the Fedora...

Fedora 42 : PackageKit (2026-41926fe792)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-41926fe792 advisory. Backport fix for race condition leading to root compromise GHSA-f55j-vvr9-69xv Tenable has extracted the preceding description block directly from the Fedora...

nix: coroutine stack-to-heap overflow via unbounded recursion in NAR directory parser

A flaw was found in Nix. Unbounded recursion in the NAR Nix Archive parser could lead to a stack-to-heap overflow when the parser is run on a coroutine stack. The stack is allocated without a guard page, which means that a stack overflow could overwrite memory on the heap and could allow arbitrar...

Fedora 44 : PackageKit (2026-6c121b3d4c)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6c121b3d4c advisory. Backport fix for race condition leading to root compromise GHSA-f55j-vvr9-69xv Tenable has extracted the preceding description block directly from the Fedora...

CVE-2026-21916

A UNIX Symbolic Link Symlink Following vulnerability in the CLI of Juniper Networks Junos OS allows a local, authenticated attacker with low privileges to escalate their privileges to root which will lead to a complete compromise of the system. When after a user has performed a specific 'file lin...