CVE-2021-36934

CVE-2021-36934 CVE-2021-36934 PowerShell 수정 이 PowerShell 스크립트는 CVE-2021-36934를 수정합니다. Joran Slingerland의 원본 스크립트를 기반으로 합니다 https://github.com/JoranSlingerland https://github.com/JoranSlingerland/CVE-2021-36934/blob/main/CVE-2021-36934.ps1 PowerShell 스크립트는 다음을 수행합니다: $env:windir\Logs\ 아래에...

Exim-CVE-2018-6789

Exim CVE-2018-6789 CVE-2018-6789を悪用するためのPoC資料。PoCを説明するブログ記事はSynacktiv ブログで入手可能です。 このPoCは脆弱なEximサーバーに接続し、CVE-2018-6789を悪用します。 使用方法 root@kitploit: usage: exploit -hv options: -h, --help Print this help -v, --verbose Enable verbose output...

CVE-2020-10551

CVEID : CVE-2020-10551 영향을 받는 제품 및 버전 : QQBrowser 10.5.3870.400 이전의 모든 버전 문제 유형 : CWE-284: 부적절한 접근 제어 Improper Access Control 요약 QQBrowser는 Tencent가 개발한 웹 브라우저입니다. 중국에서 가장 널리 사용되는 웹 브라우저 중 하나입니다. 테스트 중에 우리는 권한이 없는 로컬 공격자가 NT AUTHORITY\SYSTEM 권한으로 코드를 실행할 수 있게 하는 취약점을 발견했습니다. 10.5.3870.400 이전의 모든...

CVE-2025-12748

CVE-2025-12748 Eng Rus Авторы: Svyatoslav Tereshin @TERESH1, Artem Mukhin @saladosss Issues: 687, 825 Английский Описание Обнаружена проблема в процедуре обработки XML-файла. Обработка содержимого файла выполняется до проверки ACL. Это позволяет пользователю с ограниченными правами отправить...

EUVD-2026-66376

The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open...

CVE-2026-78597 Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation

Missing Authorization CWE-862 in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only low-privilege Security feature access could invoke an administrative operation tha...

CVE-2026-72633

Kibana Entity Analytics is affected by an Incorrect Authorization flaw (CWE-863) that allows an authenticated user with only read-level Security feature access —and no Elasticsearch privileges—to stop the recurring Privilege Monitoring engine task for a Kibana space. When this occurs, privileged ...

CVE-2026-72641 Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only Security Solution read access in a Kibana space could enumerate and change the state of Entity Store...

CVE-2022-33891

CVE-2022-33891 PoC CVE-2022-33891 の PoC です。カスタムペイロードを設定できます。 デフォルトでは脆弱ではありません。spark.acls.enable が TRUE である必要があります。 想定される用途 このスクリプトの使用は、脆弱性パッチ適用を目的としてターゲットホスト上でペイロードを実行することを許可された担当者のみに限定されます。実行前に、あなたが許可されていることを確認してください。 使用方法 root@kitploit: git clone https://github.com/west-wind/CVE-2022-33891.git...

CVE-2021-25253

root@kitploit: Exploit Title: Trend Micro OfficeScan Client 10.0 - ACL Service LPE Date: 2023/05/04 Exploit Author: msd0pe Vendor Homepage: https://www.trendmicro.com My Github: https://github.com/msd0pe-1 Клиент Trend Micro OfficeScan: Версии = icacls "C:\Program Files x86\Trend Micro\OfficeScan...

[SECURITY] [DLA 4766-1] cyrus-imapd security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4766-1 [email protected] https://www.debian.org/lts/security/ Xavier Guimard September 01, 2026 https://wiki.debian.org/LTS -...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Request Smuggling.

Summary undici is used by IBM Storage Fusion Data Foundation, which could cause Request Smuggling. CVE-2026-1525, CVE-2026-1526, CVE-2026-1527, CVE-2026-1528, CVE-2026-2229. Vulnerability Details CVEID:CVE-2026-1525 DESCRIPTION: Undici allows duplicate HTTP Content-Length headers when they are...

CVE-2026-40204

A flaw was found in Dovecot. This vulnerability allows an attacker to bypass Access Control List ACL restrictions through the ldamailboxautocreate feature. This could potentially grant unauthorized access to mailboxes or other restricted resources. Mitigation Mitigation for this issue is either n...

CVE-2022-33891

「💥」CVE-2022-33891 Описание Интерфейс Apache Spark UI предоставляет возможность включения ACL через параметр конфигурации spark.acls.enable. С помощью фильтра аутентификации он проверяет, имеет ли пользователь разрешения на просмотр или изменение приложения. Если ACL включены, код в...

PrintNightmare

심각한 보안 취약점 PrintNightmare CVE-2021-1675, CVE-2021-34527 현재 Microsoft의 해결책 없음 2021년 7월 2일 기준 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527 모든 운영 체제 버전서버 및 클라이언트에 영향 가능한 조치 PrinterSpooler 비활성화 ACL 조정 EventID Pre-Windows 2000 Compatible Access에서 Authenticated Users 제거 ACL 조정이 ...

CVE-2026-51730

Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

Reset-inetpub

inetpub 초기화 이 스크립트는 KB5055523 Windows 업데이트 이후 CVE-2025-21204에 대한 완화 조치로 필요한 %SYSTEMDRIVE%\inetpub 폴더와 해당 기본 보안 권한을 복원합니다. 이 스크립트는 보안 목적을 이해하기 전에 이 폴더를 삭제한 사용자가 IIS 기능을 활성화/비활성화하지 않고도 이 폴더를 복원하려는 경우를 위한 것입니다. 이 스크립트가 수행하는 작업 1. %SYSTEMDRIVE%\inetpub 디렉터리가 없으면 생성합니다. 2. inetpub 폴더 자체에 보안 완화에 필요한 기본...

CVE-2026-19616

Missing Authorization vulnerability in TBC Technology Inc. KitLogistic allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects KitLogistic: before v2.2.2...

CVE-2026-19616

CVE-2026-19616 is a Missing Authorization vulnerability in TBC Technology Inc. KitLogistic prior to v2.2.2 . The flaw allows an attacker to access functionality not properly constrained by ACLs , meaning unauthorized network-based access to restricted features is possible without credentials or u...

HAProxy-CVE-2023-45539-PoC

HAProxy-CVE-2023-45539-PoC HAProxy до версии 2.8.2 принимает как часть компонента URI, что может позволить удалённым злоумышленникам получить конфиденциальную информацию или вызвать иные неопределённые последствия при неправильной интерпретации правила pathend, например, маршрутизация...