hostintel

hostintel This tool is used to collect various intelligence sources for hosts. Hostintel is written in a modular fashion so new intelligence sources can be easily added. Hosts are identified by FQDN host name, Domain, or IP address. This tool only supports IPv4 at the moment. The output is in CSV...

Joomla! Component Love Factory 1.3.4 - Local File Inclusion

A directory traversal vulnerability in the Love Factory comlovefactory component 1.3.4 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1957 info: name: Joomla! Component Love Factory 1.3.4 - Local File Inclusion...

Artica Web Proxy 4.30 - OS Command Injection

Artica Web Proxy 4.30 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. These commands are executed with root privileges via servicecmdspeform. id: CVE-2020-17505 info: name: Artica Web Proxy 4.30 - OS Command Injection author: dwisiswant0...

Suprema BioStar <2.8.2 - Local File Inclusion

Suprema BioStar before 2.8.2 Video Extension allows remote attackers can read arbitrary files from the server via local file inclusion. id: CVE-2020-15050 info: name: Suprema BioStar 2.8.2 - Local File Inclusion author: gy741 severity: high description: Suprema BioStar before 2.8.2 Video Extensio...

Joomla! Component JProject Manager 1.0 - Local File Inclusion

A directory traversal vulnerability in the Ternaria Informatica JProject Manager comjprojectmanager component 1.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1469 inf...

Joomla! Component ZiMB Comment 0.8.1 - Local File Inclusion

A directory traversal vulnerability in the ZiMB Comment comzimbcomment component 0.8.1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1602 info: name: Joomla! Component...

Razer Sila Gaming Router 2.0.441_api-2.0.418 - Local File Inclusion

Razer Sila Gaming Router 2.0.441api-2.0.418 is vulnerable to local file inclusion which could allow attackers to read arbitrary files. id: CVE-2022-29014 info: name: Razer Sila Gaming Router 2.0.441api-2.0.418 - Local File Inclusion author: edoardottt severity: high description: Razer Sila Gaming...

CVE-2026-82436

The DefaultStateSerializer component in Apache Storm (specifically when using the Redis-backed state provider ) is vulnerable to arbitrary code execution. The root cause is that the component configures Kryo with class registration disabled and an instantiation strategy that constructs objects wi...

CVE-2026-82436

Description DefaultStateSerializer, used to persist and restore stateful bolt checkpoints, configured Kryo with class registration disabled and an instantiation strategy that constructs objects without invoking their constructors, then deserialized whatever bytes the state store returned. A party...

CVE-2026-82440

Description Nimbus instantiates the class named by a topology's topology.scheduler.strategy when scheduling it. The allowlist intended to constrain that choice, nimbus.scheduler.strategy.class.whitelist, was treated as "allow any class" when unset, and it had no entry in the shipped defaults.yaml...

CVE-2026-82440

The Nimbus component is vulnerable because the nimbus.scheduler.strategy.class.whitelist allowlist defaults to "allow any class" when unset. This allows an authenticated submitter to force Nimbus to instantiate any class on the classpath with a no-argument constructor. Specifically, an attacker c...

EUVD-2026-119926

Description DefaultStateSerializer, used to persist and restore stateful bolt checkpoints, configured Kryo with class registration disabled and an instantiation strategy that constructs objects without invoking their constructors, then deserialized whatever bytes the state store returned. A party...

EUVD-2026-119925

Description Nimbus instantiates the class named by a topology's topology.scheduler.strategy when scheduling it. The allowlist intended to constrain that choice, nimbus.scheduler.strategy.class.whitelist, was treated as "allow any class" when unset, and it had no entry in the shipped defaults.yaml...

WordPress Videos sync PDF <=1.7.4 - Local File Inclusion

WordPress Videos sync PDF 1.7.4 and prior does not validate the p parameter before using it in an include statement, which could lead to local file inclusion. id: CVE-2022-1392 info: name: WordPress Videos sync PDF =1.7.5 or apply the vendor-provided patch to mitigate the vulnerability. reference...

WordPress Admin Word Count Column 2.2 - Local File Inclusion

The plugin does not validate the path parameter given to readfile, which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a Phar Deserialization technique. id:...

Storm-Breaker

Storm Breaker v3 Advanced Phishing & Social Engineering Framework with MITM Proxy, Credential Harvesting, Session Hijacking, and Browser-Based Tracking. What is Storm Breaker? Storm Breaker clones a target web page and injects capture modules camera, microphone, geolocation, device-info, form...

linnix

Linnix Find which process is hurting your SLOs — not just who's using CPU, but who's causing stalls. The Problem top shows 80% CPU. Prometheus shows high latency. But which pod is actually stalling your payment service? Linnix uses eBPF + PSI Pressure Stall Information to answer this. PSI measure...

CVE-2020-0688-Python3

I got this code from Packet Storm. I used a variety of methods mainly 2to3 and a lot of tedious, manual effort to get this to run properly with Python3. Enjoy!...

CVE-2021-40865

CVE-2021-40865 CVE-2021-40865 POC/exploit-poc import org.apache.commons.io.IOUtils; import org.apache.storm.serialization.KryoValuesSerializer; import ysoserial.payloads.ObjectPayload; import ysoserial.payloads.URLDNS; import java.io.; import java.math.BigInteger; import java.net.; import...

CVE-2023-36884-MS-Office-HTML-RCE

CVE-2023-36884: MS Office HTML RCE with crafted documents On July 11, 2023, Microsoft released a patch aimed at addressing multiple actively exploited Remote Code Execution RCE vulnerabilities. This action also shed light on a phishing campaign orchestrated by a threat actor known as Storm-0978,...