NetMRI-2014-3418

NetMRI-CVE-2014-3418 - Módulo de Metasploit Módulo de Metasploit de inyección de comandos del sistema operativo en InfoBlox Network Automation Producto: Network Automation root@kitploit: NetMRI Switch Port Manager Automation Change Manager Security Device Controller Proveedor: root@kitploit:...

sadcloud

Sadcloud sadcloud is a tool for spinning up insecure AWS infrastructure with Terraform. It supports approx. 84 misconfigurations across 22 AWS Services. The inital set of misconfigurations were drawn from ScoutSuite, NCCGroup's Multi-cloud auditing tool. sadcloud was created to easily allow...

phishlulz

PhishLulz PhishLulz is a Ruby toolset aimed at automating Phishing activities. When you start a phishing campaign, a dedicated Amazon EC2 Debian 7 instance is spawned. The VM comes with various open source tools that have been glued together. The two main components are: PhishingFrenzy...

CVE-2021-4034

CVE-2021-4034 CVE-2021-4034 Add Root User - Pkexec Local Privilege Escalation Mejorado según CVE-2021-4034, al ejecutar el Exploit se añadirá por defecto el nombre de usuario rooter, la contraseña Hello@World, y el usuario rooter tendrá privilegios sudo. Refer to CVE-2021-4034, executing Exploit...

CVE-2026-0770

CVE-2026-0770: Langflow execglobals Ejecución Remota de Código No Autenticada PoC CVE-2026-0770 es una vulnerabilidad de Ejecución Remota de Código RCE no autenticada que afecta a Langflow. El fallo se origina por una validación de entrada incorrecta en el manejo del parámetro execglobals...

dirtyCow

Dirtycow también conocido como CVE-2016-5195 y es una vulnerabilidad muy popular del pasado. En primer lugar, elige la versión de Linux adecuada para esa vulnerabilidad. luego instálala o ejecútala en VBOX o VMWare. Después de instalarlo, sigue estas instrucciones. 1. Crea un usuario sin tener...

polkadots

polkadots Exploit de escalada de privilegios local CVE-2021-3560 Este exploit crea un nuevo usuario privilegiado con el que puedes escalar a root. Distribuciones afectadas: RHEL 8 Fedora 21 Debian testing Bullseye Ubuntu 20.04 Uso root@kitploit: ./polkadots -a Account -n Account name -h Password...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fbdev: pxafb: Fixed possible use after free in pxafbtask. In the pxafbprobe function, it calls the pxafbinitfbinfo function. After that, &fbi-task is associated with pxafbtask. Moreover, within this pxafbinitfbinfo function, the...

CVE-2024-22274

CVE-2024-22274: Ejecución remota de código autenticada en VMware vCenter Server El vCenter Server contiene una vulnerabilidad de ejecución remota de código autenticada. Un actor malicioso con privilegios administrativos en el shell del appliance de vCenter podría explotar este problema para...

CVE-2026-67397

Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root...

VMware VRealize Network Insight - Remote Code Execution

VMWare Aria Operations for Networks vRealize Network Insight is vulnerable to command injection when accepting user input through the Apache Thrift RPC interface. This vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on the underlying operating system as the ro...

Astra Linux – Vulnerability in OpenSSH

In OpenSSH versions prior to 10.3, a file downloaded using scp might be installed with setuid or setgid permissions, which contradicts some users’ expectations. This occurs when the download is performed as the root user with the -O legacy scp protocol option, and without the -p preserve mode...

K000163042: OpenSSH vulnerability CVE-2026-35385

Security Advisory Description In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O legacy scp protocol and without -p preserve mode. CVE-2026-35385 Impact There is no impac...

GO-2026-6240 New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api

New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api...

CVE-2026-75855

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names...

New API: User List API Leaks Root User Access Token Leading to Privilege Escalation

Vulnerability Information - Product: new-api - Affected versions: versions before v1.0.0-rc.7 that serialize User.AccessToken as accesstoken; the issue was confirmed in v0.12.14 - Patched version: v1.0.0-rc.7 - Fixed commit: 0936e2504655a5cbf7bc3c388f6d3e2bb24916d3 - Type: Information Disclosure ...

GHSA-6X2C-PHFF-WX57 New API: User List API Leaks Root User Access Token Leading to Privilege Escalation

Vulnerability Information - Product: new-api - Affected versions: versions before v1.0.0-rc.7 that serialize User.AccessToken as accesstoken; the issue was confirmed in v0.12.14 - Patched version: v1.0.0-rc.7 - Fixed commit: 0936e2504655a5cbf7bc3c388f6d3e2bb24916d3 - Type: Information Disclosure ...

CVE-2026-64859

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as accesstoken because User model objects are serialized after queries use...

CVE-2026-64859 New API: User List API Leaks Root User Access Token Leading to Privilege Escalation

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as accesstoken because User model objects are serialized after queries use...

CVE-2026-64859

In new-api before v1.0.0-rc.7, the User model's AccessToken field was serialized as "access_token" in JSON responses to admin-only endpoints (GET /api/user/ and user lookup). An authenticated admin could retrieve the root user's bearer token and impersonate root, bypassing role boundaries to acce...