569 matches found
Agent-Tesla-APC-Injection-Token-Manipulation-Registry-Persistence-Analysis
1. Native API وحقن APC يكشف تفريغ ذاكرة x64dbg أن Agent Tesla يستخدم استدعاءات Native API NT API للعمليات منخفضة المستوى، بما في ذلك حقن APC استدعاء إجراء غير متزامن. الوظائف الرئيسية التي تم رصدها: NtQueueApcThread – يحقن الكود في الخيط الهدف عبر APC. NtReadVirtualMemory – يقرأ الذاكرة من...
agent_tesla_panel_rce
agentteslapanelrce تستغل هذه الوحدة ثغرة حقن الأوامر في مركز التحكم الخاص بـ agent Tesla. الإعداد موارد الاختبار متوفرة هنا: https://github.com/mekhalleh/agentteslapanelrce/tree/master/resources ويندوز بالنسبة لـ WebPanel1.7z RCE غير مُصادق عليه، استخدمت خادم WAMP 3.1.9 x64 مع إصدار PHP 5.6.40 من...
colabcat
Colabcat Run Hashcat on Google Colab with session restore capabilities with Google Drive. Usage Go to the link below to open a copy of the colabcat.ipynb file in Google Colab: https://colab.research.google.com/github/someshkar/colabcat/blob/master/colabcat.ipynb Click on Runtime, Change runtime...
cve-2025-2082
टेस्ला को कैसे हैक करें? — इंटरैक्टिव परिदृश्य अनुप्रयोग यह प्रोजेक्ट, Synacktiv नामक सुरक्षा फर्म द्वारा खोजी गई एक वास्तविक सुरक्षा कमजोरी TPMS → VCSEC → CAN Bus श्रृंखला पर आधारित एक इंटरैक्टिव साइबर सुरक्षा परिदृश्य है। इस परिदृश्य का उद्देश्य यह नाटकीय रूप से सिखाना है कि 2024 में एक कमजोर...
Tesla-CVE-2020-10558
टेस्ला मॉडल 3 भेद्यता | CVE-2020-10558...
cve-2025-2082-POV
CVE-2025-2082 – फंक्शन पॉइंटर ओवरराइट PoV VCSEC-शैली यह रिपॉज़िटरी CVE-2025-2082 से प्रेरित एक गंभीर मेमोरी भ्रष्टाचार दोष का अनुकरण करने वाला एक प्रूफ ऑफ वल्नरेबिलिटी PoV प्रदर्शित करता है, जो टेस्ला के VCSEC Vehicle Controller Security घटक में खोजा गया था। यह भेद्यता एक हमलावर को memcpy ऑपरेशन ...
tesla-security-research
Tesla Security Research Vulnerability research on the Tesla Model 3/Y infotainment system Intel Atom MCU, Linux 4.14.235, responsibly disclosed to Tesla via Bugcrowd. Obtained persistent root access on a production Tesla Model 3 through a command injection vulnerability in Tesla's ODIN diagnostic...
CVE-2020-10558
CVE-2020-10558: Tesla Model S/3/X حجب الخدمة DoS الباحث الأمني: Jacob Archuleta @nullze 📝 نظرة عامة على الثغرة تم اكتشاف ثغرة حرجة من نوع حجب الخدمة DoS في Tesla Model 3 وModel S وModel X جميع الإصدارات السابقة للإصدار 2020.4.10. سمحت هذه الثغرة لمهاجم عن بُعد بتعطيل نظام المعلومات والترفيه المبن...
google_gax
googlegax con patch Fork con patch di googlegax v0.4.1 per la compatibilità con Tesla = 1.18.3. Perché esiste questo fork Tesla 1.18.3 2 giugno 2026 ha introdotto una validazione rigorosa dei nomi dei campi multipart tramite assertquotedstringsafe!/2 come parte delle correzioni di sicurezza per...
EUVD-2026-34012
Tesla vulnerable to multipart part smuggling via unescaped content-disposition values...
Tesla vulnerable to multipart part smuggling via unescaped `content-disposition` values
Summary Tesla.Multipart.partheadersfordisposition/1 interpolates Content-Disposition parameter values field name, filename, and other opts verbatim into the part header line without encoding or escaping any special characters. An attacker who controls a filename, field name, or other disposition...
EUVD-2026-34013
Tesla vulnerable to atom exhaustion via untrusted URL scheme...
Tesla vulnerable to atom exhaustion via untrusted URL scheme
Summary In the Mint adapter for the Tesla HTTP client library, Tesla.Adapter.Mint.openconn/2 passes the URL scheme of every outgoing request through String.toatom/1 with no allow-list validation. Because BEAM atoms are permanent never garbage-collected and the atom table is bounded at roughly...
EUVD-2026-34014
Tesla: Authorization header leaks on cross-origin redirect via case-sensitive filtering...
Tesla: Authorization header leaks on cross-origin redirect via case-sensitive filtering
Summary Tesla.Middleware.FollowRedirects is meant to strip the Authorization header when following a cross-origin redirect, but performs the check with a case-sensitive comparison against the lowercase string "authorization". Because Tesla preserves header keys exactly as supplied by the caller,...
EUVD-2026-34015
Tesla has decompression bomb on response body...
Tesla has CRLF injection in request `Content-Type` header via `add_content_type_param`
Summary Tesla.Multipart.addcontenttypeparam/2 appends caller-supplied strings to the multipart Content-Type header with no validation. A param value containing \r\n splits the header line, allowing an attacker who controls any content-type parameter charset, boundary parameter, etc. to inject...
EUVD-2026-34016
Tesla has CRLF injection in request Content-Type header via addcontenttypeparam...
GO-2026-5553 Tesla Fleet Telemetry allows spoofing telemetry for arbitrary vehicles via compromised vehicle credentials in github.com/teslamotors/fleet-telemetry
Tesla Fleet Telemetry allows spoofing telemetry for arbitrary vehicles via compromised vehicle credentials in github.com/teslamotors/fleet-telemetry...
