UnCanny

UNCanny Coerce L'idea alla base di questa ricerca era semplice: volevo trovare una mia tecnica di coercizione. Ho iniziato cercando nuove superfici d'attacco RPC, ma dopo che Microsoft ha aggiunto il monitoraggio delle attività RPC...

CVE-2022-39838

CVE-2022-39838 الوصف المقترح Systematica FIX Adapter ALFAFX 2.4.0.25 13/09/2017 يسمح بتضمين ملفات عن بُعد عبر اسم مسار مشاركة UNC، كما يسمح بعبور المسار المطلق إلى مسارات محلية. معلومات إضافية PoC: http://192.168.88.11:8888/info?page=logfile&file=C:\Windows\System32\drivers\etc\hosts...

CVE-2023-23397

CVE-2023-23397 Una prova di concetto per CVE-2023-23397 per test di sicurezza. Modificare le righe 11 e 12 con il percorso UNC dell'attaccante e l'indirizzo email del destinatario...

CVE-2025-33053-Checker-PoC

Checker della vulnerabilità CVE-2025-33053 e Proof-of-Concept PoC Prova del Checker Prova del PoC Una suite completa di strumenti per verificare e dimostrare la potenziale sfruttabilità di CVE-2025-33053 , una vulnerabilità critica di Remote Code Execution RCE basata su WebDAV che colpisce i...

CVE-2023-23397_EXPLOIT

Exploração da Vulnerabilidade CVE-2023-23397 no MS Outlook CVE-2023-23397 é uma vulnerabilidade no Microsoft Outlook que permite que um invasor potencialmente exfiltre detalhes de autenticação do usuário. A vulnerabilidade decorre da capacidade de um invasor especificar um caminho UNC Universal...

ms-photos_NTLM_Leak

Microsoft ms-photos URI NTLM लीक एक क्लिक से ब्राउज़रों से NTLM हैश लीक करने की अनुमति देने वाली नई भेद्यता द्वारा Ruben Enkaoua विवरण Microsoft ms-photos URI स्कीम fileName को पैरामीटर के रूप में लेती है, जिसे UNC पथ के साथ सबमिट किया जा सकता है, जिससे खोलने पर NTLMv2-SSP हैश लीक हो जाते हैं। एक...

windows-coerced-authentication-methods

Dieses Repository enthält eine Liste vieler Methoden, um eine Windows-Maschine dazu zu zwingen, sich bei einer vom Angreifer kontrollierten Maschine zu authentifizieren. Alle diese Methoden können von einem Standardbenutzer in der Domäne aufgerufen werden, um das Maschinenkonto der...

CVE-2026-62960 Git for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windows

Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transportgetremotebundleuri, fetchbundleuriinternal, and copyuritofile in bundle-uri.c during clone or fetch when transfer.bundleuri=true. Non-HTTPS values...

CVE-2026-62960 Git for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windows

Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transportgetremotebundleuri, fetchbundleuriinternal, and copyuritofile in bundle-uri.c during clone or fetch when transfer.bundleuri=true. Non-HTTPS values...

CVE-2026-62960

Git for Windows prior to 2.55.0.windows.4 is vulnerable to a security bypass in bundle-uri.c . When transfer.bundleuri=true, a malicious remote Git server can advertise a bundle URI processed by transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file(). Non-HTTP(S) va...

CVE-2026-54205

Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality //ServerClientcelink.htm accepts a “pathname” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection...

CVE-2026-54207

Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality “!ArcEntryMove” accepts an arbitrary path, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...

EUVD-2026-54437

Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a @@INCLUDE command, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...

CVE-2026-64816

RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open in lutprocessing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is...

CVE-2026-64816 RapidRAW < 1.6.0 NTLMv2 Credential Leak via UNC Path in lutPath

RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open in lutprocessing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is...

CVE-2026-64816 RapidRAW < 1.6.0 NTLMv2 Credential Leak via UNC Path in lutPath

RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open in lutprocessing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is...

CVE-2026-25039

Parsec is a cloud-based application for simple and cryptographically secure file sharing. The application does not sanitize the workspace name, creating a vulnerability if that workspace name is a UNC path. When creating mountpoint in the windows filesystem to mount the workspace of an...

CVE-2026-25039 The application evaluate UNC path in workspace name

Parsec is a cloud-based application for simple and cryptographically secure file sharing. The application does not sanitize the workspace name, creating a vulnerability if that workspace name is a UNC path. When creating mountpoint in the windows filesystem to mount the workspace of an...

PT-2026-61598

Name of the Vulnerable Software and Affected Versions Parsec affected versions not specified Description Parsec is a cloud-based application for secure file sharing. The application fails to sanitize the workspace name when creating a mountpoint in the Windows filesystem to mount an organization'...

CVE-2026-8919

Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application’s local service endpoint. This can result in...