CVE-2025-31651-o

CVE-2025-31651 드문 재작성 규칙 구성의 하위 집합에 대해 특별히 조작된 요청이 일부 재작성 규칙을 우회할 수 있었습니다. 해당 재작성 규칙이 보안 제약 조건을 효과적으로 적용한 경우, 해당 제약 조건이 우회될 수 있었습니다. 0x01 상태 공개 0x02 PoC Finder 참조 CVE-2025-31651.md...

CVE-2026-23008-Solidity-Assembly-Return-Data-Size-Confusion

CVE-2026-23008 – Solidity 어셈블리 반환 데이터 크기 혼동 프로그램 코드Solidity root@kitploit: // ReturnSizeConfusion.sol contract Victim function callExternaladdress target external returns bytes memory bool success, bytes memory ret = target.callabi.encodeWithSignature"someFunc"; requiresuccess, "call failed"; //...

EUVD-2024-55769

A cross-site scripting XSS vulnerability has been reported to affect QcalAgent. The local attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.9 and later...

Sudo-Security-Bypass-Vulnerability

이 저장소에는 README가 없습니다...

CVE-2023-2640-32629

Ubuntu 권한 상승: CVE-2023-2640 및 CVE-2023-32629 이 취약점은 특정 Ubuntu 커널에 영향을 미치는 로컬 권한 상승 취약점입니다. 비특권 사용자가 마운트된 파일에 특권 확장 속성을 설정하여 보안 검사를 우회하고 잠재적으로 상승된 권한을 얻을 수 있게 합니다. 이 취약점과 관련된 CVE는 CVE-2023-2640 및 CVE-2023-32629입니다. 영향을 받는 커널에는 다양한 Ubuntu 릴리스에 걸쳐 6.2.0, 5.19.0 및 5.4.0 버전이 포함됩니다. 이러한 취약점을 완화하려면...

CVE-2020-15916

KO GenLANConfigAttack - 는 CVE-2020-15916 을 악용하는 PoC로, 기기의 LAN 구성을 무단으로 변경할 수 있는 취약점입니다. 기능 LAN 구성 취약점 악용 악성 페이로드를 전송하여 네트워크 설정 변경 LAN 제어를 위한 보안 메커니즘 우회 사용 방법 1. 이 저장소를 클론합니다: root@kitploit: git clone https://github.com/geniuszly/CVE-2020-15916 2. 종속성을 설치합니다: root@kitploit: pip install -r...

Spring4Shell

Spring4Shell 이 챌린지에서는 Spring4ShellCVE-2022-22965 취약점을 분석하고, 보안 우회 기법을 조사했으며, 공격의 탐지, 영향 및 해결을 상세히 기술한 사고 사후 분석 보고서를 작성했습니다. 또한 Python으로 방화벽 규칙을 구현하여 악성 요청을 차단하고 향후 악용을 방지했습니다...

The vulnerability of the Rsync file transfer and synchronization utility, related to bypassing authentication through spoofing, allows a perpetrator to circumvent existing security mechanisms.

The vulnerability of the Rsync file transfer and synchronization utility relates to the bypassing of authentication processes through spoofing. Exploiting this vulnerability allows a malicious actor to circumvent existing security mechanisms remotely...

The vulnerability of the match_hostname() function in the Rsync file transfer and synchronization utility allows a attacker to bypass existing security mechanisms.

The vulnerability of the matchhostname function in the Rsync file transfer and synchronization utility is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to bypass existing security mechanisms remotely...

tomcat9 security update

1:9.0.120-1 - Resolves: RHEL-192649 Tomcat9: Improper Input Validation vulnerability due to incomplete fix CVE-2026-32990 - Resolves: RHEL-192818 Tomcat9: HTTP/2 request headers not validated CVE-2026-41293 - Resolves: RHEL-219582 Tomcat9: Insufficient documentation for EncryptInterceptor may lea...

CVE-2023-20860

학습용 CVE-2023-20860: 접두사 없는 이중 와일드카드 패턴을 통한 보안 우회 Spring Framework 6.0.7 및 5.3.26에서 cve-2023-20860 및 cve-2023-20861 수정...

sweyntooth_bluetooth_low_energy_attacks

SweynTooth - Bluetooth Low Energy를 통한 대혼란 유발 이 저장소는ASSET Research Group의 연구 성과의 일부입니다. SweynTooth는 6개 주요 시스템온칩SoC 벤더의 서로 다른 Bluetooth Low Energy BLE 소프트웨어 개발 키트SDK 전반에 걸친 18개 취약점 군을 포착합니다. 이 취약점들은 특정 BLE SoC 구현의 결함을 드러내며, 무선 범위 내의 공격자가 상황에 따라 교착 상태, 충돌 및 버퍼 오버플로 를 유발하거나 보안 을 완전히 우회 할 수 있게 합니다. 업데...

tomcat-coyote: tomcat: Improper Authorization allows security bypass

In Apache Tomcat, when multiple security constraints defined an HTTP method constraint for the same extension pattern, only the first method constraint was applied. A remote attacker could exploit this to bypass intended security restrictions for information or actions within the application...

Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix

A flaw was found in Apache Tomcat. This improper input validation vulnerability stems from an incomplete fix for a previous security issue CVE-2025-66614. This flaw may allow an attacker to bypass security controls or cause unexpected behavior within the application...

tomcat-coyote: tomcat: Improper Authorization allows security bypass

In Apache Tomcat, when multiple security constraints defined an HTTP method constraint for the same extension pattern, only the first method constraint was applied. A remote attacker could exploit this to bypass intended security restrictions for information or actions within the application...

Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix

A flaw was found in Apache Tomcat. This improper input validation vulnerability stems from an incomplete fix for a previous security issue CVE-2025-66614. This flaw may allow an attacker to bypass security controls or cause unexpected behavior within the application...

tomcat-coyote: tomcat: Improper Authorization allows security bypass

In Apache Tomcat, when multiple security constraints defined an HTTP method constraint for the same extension pattern, only the first method constraint was applied. A remote attacker could exploit this to bypass intended security restrictions for information or actions within the application...

Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix

A flaw was found in Apache Tomcat. This improper input validation vulnerability stems from an incomplete fix for a previous security issue CVE-2025-66614. This flaw may allow an attacker to bypass security controls or cause unexpected behavior within the application...

Important: Red Hat Security Advisory: tomcat security update

An update for tomcat is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

tomcat-coyote: tomcat: Improper Authorization allows security bypass

In Apache Tomcat, when multiple security constraints defined an HTTP method constraint for the same extension pattern, only the first method constraint was applied. A remote attacker could exploit this to bypass intended security restrictions for information or actions within the application...