ysoserial.net

A proof-of-concept tool for generating payloads that exploit unsafe .NET object deserialization. Description ysoserial.net is a collection of utilities and property-oriented programming "gadget chains" discovered in common .NET libraries that can, under the right conditions, exploit .NET...

pythem

pythem - Penetration Testing Framework pythem is a multi-purpose pentest framework written in Python. It has been developed to be used by security researchers and security professionals. The tool intended to be used only for acts within the law. I am not liable for any undue and unlawful act...

CVE-2024-3094

CVE-2024-3094 XZ-Utils Vulnerability Checker and Fixer This Bash script checks for vulnerable versions of xz-utils installed on your system and offers to replace them with a stable, uncompromised version. Requirements wget tar make sudo Usage 1. Ensure you have the required dependencies installed...

-CVE-2024-3094-Vulnerability-Checker-Fixer-Public

Show Your Support If you find this script useful and it has helped you safeguard your systems against CVE-2024-3094, please consider giving it a star ⭐ . Starring this repository not only shows your support but also helps more people discover and benefit from our collective effort to improve...

CVE-2024-3094-XZ-Backdoor-Detector

Description Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific...

CVE-2024-3094-Vulnerabity-Checker

CVE-2024-3094-Vulnerabity-Checker Verify that your XZ Utils version is not vulnerable to CVE-2024-3094 ┌──lypd0㉿kali- └─$ ./CVE-2024-3094checker.sh / / \ / \ \ /. | / \ / \ /. | \ / / / / / \ \ / \ / / / / / You are NOT vulnerable to CVE-2024-3094. Background CISA Cybersecurity and...

cve-2020-0601-utils

This repository does not have a README...

CVE-2026-112780

The Grav content management system, versions 2.0.15 before 2.2.2 , is vulnerable to an allowlist bypass that enables arbitrary public static method calls. By renaming Flex form fields with replace-name@, an attacker with page-edit permissions can bypass callable checks to smuggle data-*@ directiv...

EUVD-2026-104586

Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-@ directives past the callable check to invoke...

CVE-2024-3094-checker

CVE-2024-3094 Detection and Remediation Script This script is designed to detect and remediate a critical vulnerability, CVE-2024-3094, which affects the XZ Utils data compression library. The vulnerability was highlighted in a CISA Alert and has significant implications for system security. This...

XZ-Utils_CVE-2024-3094

Vulnerability Overview XZ is a data compression format present in almost every Linux distribution. liblzma is an open-source software library that handles XZ compression format. On March 29, developers discovered a supply chain attack on the XZ package, tracing it to a backdoor trojan implanted i...

xz-backdoor-research

CVE-2024-3094 Research Toolkit By Nikolaos Natsopoulos , IAM Consultant Interactive browser-based tool accompanying the research report: "CVE-2024-3094: Supply Chain Compromise via Social Engineering and Build System Manipulation in XZ Utils" 10.5281/zenodo.20700609 About In March 2024, a backdoo...

cs50-cybersecurity-final-project

Technical Analysis of the XZ Utils Backdoor CVE-2024-3094 Video URL: https://www.youtube.com/watch?v=6hpVp7prlO8 Overview This repository contains the final project for CS50's Introduction to Cybersecurity. The project provides a thorough technical analysis of the supply chain attack on XZ Utils...

CVE-2024-3094-XZ-Utils-Check

JB-Network - check-xz.sh Utility to check if you have a vulnerable version according to CVE-2024-3094. Installation To use it, open your terminal and run: cd;mkdir git;git clone https://github.com/jbnetwork-git/linux-tools.git chmod +x /git/check-xz.sh How to run? cd /git ./check-xz.sh License. M...

Emerson Dixell XWEB-500 - Arbitrary File Write

Emerson Dixell XWEB-500 contains an arbitrary file write caused by unauthenticated access to /cgi-bin/logoextraupload.cgi, /cgi-bin/calsave.cgi, and /cgi-bin/loutils.cgi, letting attackers write any file on the system, exploit requires no authentication. id: CVE-2021-45420 info: name: Emerson...

PT-2026-117223

A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function load word2vec as vocab tensor of the file hanlp/utils/torch util.py. The manipulation of the argument vectors.vocab leads to deserialization. The attack is possible to be carried out remotely...

xzwhy

xzwhy / / / / \ / /\ This project is a Kubernetes-friendly Proof of Concept POC for CVE-2024-3094 affecting XZ Utils. See this article for an excellent walkthrough of the exploit's provenance and mechanics. WARNING ⚠⚠⚠ Running any of the commands below may result in the deployment of a vulnerable...

Detectar-Backdoor-en-liblzma-de-XZ-utils-CVE-2024-3094-

Detect-Backdoor-in-liblzma-of-XZ-utils-CVE-2024-3094- The following YARA rule helps detect the presence of the backdoor in the compromised liblzma library on systems using versions 5.6.0 and 5.6.1 of the XZ compression tool. This provides a mechanism to identify vulnerable systems that could be...

cve-2024-3094

🛡️ Cybersecurity Project: Analyzing the XZ Backdoor in liblzma 📄 Overview This project analyzes the high-profile backdoor discovered in xz-utils liblzma , affecting versions 5.6.0 and 5.6.1. The malicious code introduced into the upstream build system targeted SSH authentication by modifying how...

CVE-2024-3094

🚨 CVE-2024-3094 — XZ Utils Backdoor 🧠 Overview CVE-2024-3094 is a critical supply chain compromise affecting the widely used XZ Utils compression library. A malicious actor inserted a stealth backdoor into upstream releases, enabling remote code execution RCE via tampered liblzma. ⚠️ This...