CVE-2024-4883

CVE-2024-4883 CVE-2024-4883 的 PoC：Progress WhatsUp Gold WriteDatafile 未授权远程代码执行（CVE-2024-4883） 技术分析 漏洞的根本原因分析可在我博客上找到： https://summoning.team/blog/progress-whatsup-gold-WriteDataFile-CVE-2024-4883-RCE/ 用法 root@kitploit: WhatsUpWriteDataFileExploit.exe --target 192.168.0.11 --port 9643 --webshell...

CVE-2020-1362

利用Windows 10中的权限提升漏洞（CVE-2020-1362） 利用内存损坏漏洞——CVE-2020-1362分析 在最近的补丁星期二中，WalletService修复了权限提升漏洞，其中一个漏洞被分配为CVE-2020-1362。该漏洞利用了服务中的越界错误。在此我们分享利用该漏洞的技术。 根本原因分析 我们对walletservice.dll中的以下函数进行了二进制分析： Wallet::WalletCustomProperty::SetGroup SetGroup函数将用户控制的数据写入用户控制的偏移量的内存中。 root@kitploit: signed int64...

CVE-2020-1206

En la vulnerabilidad SMBGhost CVE-2020-0796 hablé sobre una técnica de primitiva write-what-where mediante el uso de una vulnerabilidad de desbordamiento de enteros para cambiar el puntero Alloc.Userbuffer para que apunte a una dirección deseada y escribir datos arbitrarios en ella. Al igual que...

LPE---CVE-2020-0796

Uso: Asegúrese de que Python esté instalado y luego ejecute poc.py. Windows Kernel Write-What-Where CVE-2020-0796 Exploit Diseñado únicamente para fines educativos y de prueba en entornos corporativos. MasterSpl0it no se hace responsable del código, úselo bajo su propio riesgo. POC reescrito de...

CVE-2019-0752

https://www.thezdi.com/blog/2019/5/21/rce-without-native-code-exploitation-of-a-write-what-where-in-internet-explorer CVE-2019-0752的PoC漏洞利用 针对Windows 10 x64（最高至RS4、RS5？）上的Internet Explorer 11 32位 除了某些路径魔法外，还使用特殊地址值以避免使用PowerShell和块注释 使用JavaScript创建必要的DOM元素以避免使用静态HTML 没有硬编码的偏移量...

CVE-2026-43499-ZFOLD4

CVE-2026-43499-ZFOLD4 CVE-2026-43499（IonStack PI write-what-where）的设备专项研究移植， 适用于加拿大版 Galaxy Z Fold4 SM-F936W ，固件版本 F936WVLU1AVGA 。 本仓库是 CVE-2026-43499-S24U 和 CVE-2026-43499-A36 的 Fold4 对应版本。它 记录了当前未完成 的进展：回收、残留栈 UAF 布防、 以及 leftover.lock 覆盖均已就位；7 的 lock.waiters 插入 从未落到被回收的页面上。CFI / physrw / root 尚...

CVE-2026-36981-Kernel-EoP-PoC

CVE-2026-36981-Kernel-EoP-PoC MiniTool 的 pwdrvio.sys 内核驱动中存在内核写-写-何处（write-what-where）条件。演示了一种借助调试器实现的任意内核写入原语，可用于权限提升。 2026-02-09 已通知厂商 2026-03-05 厂商已确认 2026-03-05 已向 MITRE 申请 CVE 2026-05-10 在 90 天协调披露期后公开披露 https://github.com/user-attachments/assets/ac81d7ce-0be7-40a5-9334-c54350e6e30e 任意内核写入 →...

POC_CVE-2025-29943_Write-what-where-Condition

StackWarp: PoC for CVE-2025-29943 Proof of concept for the StackWarp hardware vulnerability CVE-2025-29943 in AMD processors. This flaw allows an attacker with administrator privileges on a host hypervisor to manipulate the CPU pipeline configuration to corrupt the stack pointer within a SEV-SNP...

CVE-2020-1337-exploit

CVE-2020-1337 Windows 权限提升 这是一个 WWW（写-什么-哪里）漏洞利用 致谢 Junyu Zhou（@md5salt），他告诉我可能存在一个新漏洞。 Wenxu Wu（@ma7h1as），我发现了该漏洞并编写了这个利用程序。 工作原理 在 CVE-2020-1048 的补丁中，微软在 XcvData 函数中增加了对 portname 的验证代码。 该验证可通过在 PowerShell 中调用 Add-Printer 来触发。 现在，AddPort 和 XcvData 函数都会检查当前用户是否有权访问 portname。 但我们仍然可以使用 junction...

CVE-2026-81579

In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey264.sys kernel driver for 64-bit Windows allows an attacker to exploit a write-what-where primitive, enabling local privilege escalation. This can be leveraged to execute arbitrary code, run an administrato...

CVE-2026-81579 An untrusted Pointer Dereference can be exploited to escalate privileges by an unprivileged user on Windows

In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey264.sys kernel driver for 64-bit Windows allows an attacker to exploit a write-what-where primitive, enabling local privilege escalation. This can be leveraged to execute arbitrary code, run an administrato...

CVE-2026-81579

WibuKey for Windows (versions before 6.71 ) is affected by an untrusted pointer dereference in the WibuKey2_64.sys kernel driver (64-bit Windows), which exposes a write-what-where primitive. This enables a local unprivileged user to escalate privileges, potentially executing arbitrary code, spawn...

EUVD-2026-66984

In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey264.sys kernel driver for 64-bit Windows allows an attacker to exploit a write-what-where primitive, enabling local privilege escalation. This can be leveraged to execute arbitrary code, run an administrato...

PT-2026-82480

Name of the Vulnerable Software and Affected Versions WibuKey for Windows versions prior to 6.71 Description An untrusted pointer dereference in the WibuKey2 64.sys kernel driver for 64-bit Windows allows a local attacker to exploit a write-what-where primitive. This primitive enables local...

Astra Linux – Vulnerability in exempi

The XMP Toolkit SDK version 2020.1 and earlier is affected by a write-what-where condition vulnerability that occurs during the application’s memory allocation process. This may cause the memory management functions to become mismatched, resulting in local application denial of service in the...

Astra Linux – Vulnerability in TIF format

A flaw was discovered in Libtiff. This vulnerability operates under the “write-what-where” condition, and is triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file’s metadata, an attacker can trick the library into...

Astra Linux – Vulnerability in Blender

An integer overflow in the processing of loaded 2D images leads to a “write-what-where” vulnerability and an “out-of-bounds read” vulnerability. This allows attackers to leak sensitive information or execute code within the Blender process when a specially crafted image file is loaded. This flaw...

Exploit for Write-what-where Condition in Linux Linux_Kernel

No d...

B&R Automation X20EDS410 Write-what-where Condition (CVE-2026-43284)

The Linux kernel version shipped with the affected B&R product X20EDS410 is affected by a vulnerability. A flaw in the kernel's xfrm ESP input path that decrypts in place over shared skb frags. Successful local exploitation of this vulnerability could allow an authenticated attacker with low...

Siemens SIMATIC S7-1500 CPU 1518 MFP Write-what-where Condition (CVE-2026-46300)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505871; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...