GeoServer Demo Request Endpoint - Server Side Request Forgery

It is possible to achieve Server Side Request Forgery SSRF via the Demo request endpoint if Proxy Base URL has not been set. An unauthenticated user can supply a request that will be issued by the server, allowing enumeration of internal networks and, in the case of cloud instances, access to...

Vulnerable-Docker-Engine

CVE-2021-41091 This exploit offers an in-depth look at the CVE-2021-41091 security vulnerability and provides a step-by-step guide on how to utilize the exploit script to achieve privilege escalation on a host. Vulnerability Summary CVE-2021-41091 is a flaw in Moby Docker Engine that allows...

CVE-2023-2002

Linux Bluetooth: Unauthorized management command execution CVE-2023-2002 An insufficient permission check has been found in the Bluetooth subsystem of the Linux kernel when handling ioctl system calls of HCI sockets. This causes tasks without the proper CAPNETADMIN capability can easily mark HCI...

cve-2024-31317

Exploration of CVE-2024-31317 CVE-2024-31317 provides unpriviledged access to any uid and SELinux scope available to proper Android apps. This provides access to uid 1000 system and uid 2000 shell, and can be triggered entirely from an unpriviledged app, allowing for persistence of any...

CVE-2026-28867-PoC

CVE-2026-28867 How it works The vulnerability exists because the kernel implementation of tcpsysctlinfo performs a global lookup for the connection without verifying that the calling process either owns the socket or possesses elevated privileges like root. Impact An unprivileged attacker can...

CVE-2022-0847

CVE-2022-0847 Linux “Dirty Pipe” vulnerability gives unprivileged users root access...

serviceDetector

serviceDetector Rileva se un servizio è installato alla cieca e/o in esecuzione se espone named pipe su una macchina remota senza utilizzare privilegi di amministratore locale. Informazioni Più in dettaglio, l'esecuzione di questo script si connette al servizio SMB di destinazione 445/tcp da remo...

secpub

Cisco Nexus OS NX-OS - Problemas de "injeção" / sanitização de comandos. Descoberto por: Peter Adkins [email protected] Acesso: Local; é necessário acesso autenticado. Rastreamento e identificadores: CVE - CVE-2011-2569 SOs afetados: Cisco Nexus OS NX-OS Envolvimento do fornecedor: Alertado ...

CVE-2023-42791_CVE-2024-23666

Script di sfruttamento per Fortimanager: controlli di autorizzazione insufficienti CVE-2024-23666 e upload di file senza restrizioni CVE-2023-42791 Sono forniti due script di sfruttamento che sfruttano queste vulnerabilità: rce.py: Fornisce una reverse shell o aggiunge un amministratore arbitrari...

CVE-2022-1972-infoleak-PoC

CVE-2022-1972 infoleak PoC Exploit infoleak per CVE-2022-1972. Puoi trovare l'articolo associato sul nostro blog Requisiti I namespace utente devono essere disponibili per utenti non privilegiati. root@kitploit: $ sysctl kernel.unprivilegedusernsclone kernel.unprivilegedusernsclone = 1 Compilazio...

Astra Linux – Vulnerability in Containerd

Containerd is an open-source container runtime that emphasizes simplicity, robustness, and portability. A bug was discovered in Containerd where container root directories and certain plugins had insufficiently restricted permissions, allowing unprivileged Linux users to access the contents of...

EUVD-2026-64552

In the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down vxlanchangelink arms vxlan-agetimer whenever the requested ageing interval differs from the configured one: if conf.ageinterval != vxlan-cfg.ageinterval...

CVE-2026-49431

CVE-2026-49431 is an access control flaw in the OpenZFS component of FreeBSD (all supported versions). The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user, allowing any unprivileged local user to set the internal ZFS metadata flag $hasrecvd on a dataset, falsely...

CVE-2026-72117

A flaw was found in the Linux kernel's CAN Controller Area Network Broadcast Manager BCM module. A data race condition exists in the bcmrxhandler function where the rxstamp and rxifindex values are written without proper locking. This can lead to a "torn store" of the 64-bit rxstamp on 32-bit...

CVE-2026-72049

A flaw was found in the Linux kernel's IEEE 802.15.4 LLSEC subsystem. A local user without special privileges could exploit ungated legacy dump operations to read raw 16-byte AES-128 keys from the kernel keytable on wireless personal area network WPAN devices. This information disclosure...

kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges

A flaw was found in the Linux kernel in net/can/bcm.c in can: bcm, where an unprivileged local user can exploit this vulnerability to execute arbitrary code within the kernel, which leads to a local privilege escalation LPE. This allows the attacker to gain root privileges and take full control o...

The vulnerability in the driver/media/PCI/CX25821/CX25821-core.c component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the drivers/media/pci/cx25821/cx25821-core.c component in the Linux operating system is related to improper memory release before removing the last reference. Exploiting this vulnerability can allow an attacker to cause a service failure...

SUSE CVE-2026-74503

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Clear SNDRVTIMERIFLGDEAD once the close completes sndtimercloselocked marks an instance with SNDRVTIMERIFLGDEAD and returns early when the flag is already set, but the flag is never cleared again. A completed close...

CVE-2026-74504

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix division by zero in initializetimer A userspace-driven ALSA timer SNDUTIMER lets an unprivileged user set the backing sndtimer's hardware resolution to an arbitrary 64-bit value via SNDRVTIMERIOCTLCREATE...

CVE-2026-74483

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't leak the user namespace when the mount fails bmgettree takes a reference to the user namespace and hands it to gettreekeyed as the sget key. sgetfc moves that reference into sb-sfsinfo and clears fc-sfsinfo, so...