ethical-hacking-CVE-2011-2523

倫理的ハッキング | 評価課題1 実践的な脆弱性テスト - CVE-2011-2523 vsftpd 2.3.4 バックドア モジュール: - 倫理的ハッキング 大学: London Metropolitan University プログラム: BSc Hons Cyber Security and Forensic Science 法的免責事項 すべての活動は教育目的のみの制御された隔離された仮想ラボで実施されました。実際のシステムは対象としていません。すべての作業は1990年コンピュータ乱用法に準拠しています。 ラボ環境 攻撃側OS: Kali Linux ホスト 攻撃側IP:...

CVE-2019-20933

CVE-2019-20933 InfluxDB 1.7.6 之前版本在 services/httpd/handler.go 的 authenticate 函数中存在一个身份认证绕过漏洞，因为 JWT 令牌可能具有空的 SharedSecret（也就是共享密钥）。 （参见 https://nvd.nist.gov/vuln/detail/CVE-2019-20933 了解更多详情） PoC 此 PoC 利用上述 CVE 制作了一个快速而粗糙的 influxDB 客户端。 用法: usage: influx-client.py -h --host HOST --port PORT --use...

CVE-2019-19654

CVE-2019-19654 Chevereto のサービス拒否 - /dashboard/bulk ツール内の = 3.13.5 Core。 管理者アカウントを持つ攻撃者は任意のパスを挿入できます。一括インポーターはアクセス権を持つすべてのファイルとフォルダを削除します。基本的に、ウェブサイトを自己破壊させることができます。 「import」にジョブを追加 /var/www/html POST /json HTTP/1.1 Host: 192.168.0.88 User-Agent: Mozilla/5.0 X11; Ubuntu; Linux x8664; rv:70.0...

CVE-2026-85487

A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion...

CVE-2026-85423

A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the...

CVE-2026-85489

An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and...

CVE-2026-85421

A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can issue control commands, alter cluster states,...

kernel: svcrdma: Reject inline replies that overflow the pull-up buffer

A flaw was found in the Linux kernel's svcrdma component, which handles network communication using Remote Direct Memory Access RDMA. A remote attacker can send a specially crafted network reply that is larger than expected. This can cause the system to write data beyond the intended memory area,...

FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can exploit an out-of-bounds read vulnerability in the URBDRC USB device redirection channel. By sending a specially crafted message, the server can cause the FreeRDP client to read beyond its allocated memory, leading to...

FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption.

A flaw was found in FreeRDP. A malicious RDP Remote Desktop Protocol server or a man-in-the-middle attacker could exploit a heap buffer overflow vulnerability during connection negotiation, prior to authentication. By sending a specially crafted Server Redirection PDU Protocol Data Unit with an...

Important: Red Hat Security Advisory: freerdp security update

An update for freerdp is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can trigger a null pointer dereference in the gdisurfacebits function by sending a specially crafted Surface Bits command that claims to use the NSCodec codec ID. This vulnerability exists even when the NSCodec is disable...

[SECURITY] [DLA 4827-1] python3.11 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4827-1 [email protected] https://www.debian.org/lts/security/ Andrej Shadura October 08, 2026 https://wiki.debian.org/LTS -...

perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting

A flaw was found in perl-DBI. When casting numeric values to the SQLNUMERIC type using the sqltypecast function, the component incorrectly handles numeric values as strings without converting them first. An attacker capable of supplying numeric input to an affected application can trigger an...

Important: Red Hat Security Advisory: perl-DBI security update

An update for perl-DBI is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

kernel: smb: client: fix double-free in SMB2_flush() replay

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a double-free error within the SMB2flush replay mechanism, occurs when the system attempts to free a memory buffer twice. A malicious SMB server could exploit this by sending a specially crafted flush...

kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege escalation

A flaw was found in the Linux kernel's Server Message Block SMB client. A double-free vulnerability exists in the SMB2ioctl replay path, where a response buffer can be freed twice under specific error conditions. A malicious or compromised SMB server could exploit this by sending crafted response...

kernel: smb: client: fix query_info() replay double-free

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a double-free error, occurs when the queryinfo replay mechanism attempts to free a response buffer that has already been released. This can happen if an error occurs during the initialization of an SMB2...

kernel: af_unix: Unlink scc_entry in unix_del_edge()

A flaw was found in the Linux kernel's afunix component. A race condition during concurrent send and close operations can lead to the garbage collector GC partially freeing a Strongly Connected Component SCC. This inconsistent state may cause subsequent GC operations to iterate over a partially...

kernel: udf: fix partition descriptor append bookkeeping

A flaw was found in the Linux kernel's Universal Disk Format UDF filesystem. A remote attacker could exploit this vulnerability by tricking a user into mounting a specially crafted UDF image containing repeated partition descriptors. This could lead to a heap out-of-bounds write, potentially...