110 matches found
CVE-2025-1055-poc
CVE-2025-1055-poc CVE-2025-1055 및 CVE-2025-52915를 위한 PoC, K7RKScan.sys 사용. 이 PoC는 0x222018 IOCTL을 사용하여 임의의 프로세스를 종료합니다. 사용법 드라이버 설치: sc.exe create K7RKScan1516.sys binPath=C:\Users\Administrator\Downloads\K7RKScan1516.sys type=kernel && sc.exe start K7RKScan1516.sys PoC 실행: exploit.exe MsMpEng.ex...
CVE-2025-66676
CVE-2025-66676 IOBit Unlocker 1.3.0.11 및 이전 버전에서, 애플리케이션이 파일 잠금 해제를 시도함으로써 임의의 프로세스를 종료할 수 있습니다. 배경 이 애플리케이션은 잠금 해제된 파일의 잠금을 해제하는 데 사용됩니다. 실행 중인 프로세스의 프로세스 이미지 파일을 잠긴 파일로 지정하면, IOBit Unlocker는 커널 모드에서 해당 실행 중인 프로세스프로세스 이미지 파일을 '잠근' 프로세스를 종료하려고 시도합니다. 체크섬을 사용하여 임의의 프로세스가 드라이버와 상호작용하는 것을 방지하는 간단한 제...
CVE-2026-91784 Argument Injection leading to arbitrary process termination in gotop
cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- e.g. containing a target user's UID. When the user running...
CVE-2026-103764
Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted SessionHeader with arbitrary addr and size...
CVE-2025-60349
CVE-2025-60349: Pxscan 임의 프로세스 종료 Prevx v3.0.5.220에서 발견된 문제로, 공격자가 pxscan.sys 드라이버에 IOCTL 코드 0x22E044를 전송하여 서비스 거부DoS를 유발할 수 있습니다. 레지스트리 키 HKEYLOCALMACHINE\System\CurrentControlSet\Services\pxscan\Files 아래에 나열된 모든 프로세스가 종료됩니다. 2025년 8월, Dylan Reuter가 발견했습니다. 참고 자료:...
CVE-2026-36425
CVE-2026-36425 : OPSWAT AppRemover 임의 프로세스 종료 요청 시 모든 프로세스를 종료할 수 있는 서명된 OPSWAT 커널 드라이버입니다. 관리자 권한이 필요 없고, 권한 검사도 없으며, 어떤 질문도 하지 않습니다. EDR, 안티바이러스, PPL로 보호된 프로세스를 지정하면 해당 프로세스가 종료됩니다. 세 가지 종료 방법이 모두 커널 모드에서 실행되며, 모든 로컬 사용자의 단일 IOCTL로 트리거됩니다. 16개의 취약한 드라이버 변종이 확인되었으며, 모두 유효하게 서명되었습니다. ⚠️ 이 저장소는 교육 ...
CVE-2026-100599
OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chrome command accepts caller-supplied audio command arrays and executes them on a paired node without going through the normal system.run approval flow. In...
CVE-2026-100599
OpenClaw versions 2026.5.1 through 2026.7.0 are vulnerable to Remote Code Execution because the googlemeet.chrome command fails to apply the configured exec approval path. The command accepts caller-supplied audio command arrays and executes them on a paired node, bypassing the standard system.ru...
EUVD-2026-87381
OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chrome command accepts caller-supplied audio command arrays and executes them on a paired node without going through the normal system.run approval flow. In...
CVE-2026-15599 Arbitrary Process Termination in TÜBİTAK BİLGEM's pardus-domain-joiner
Unverified ownership vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-domain-joiner allows Privilege Abuse. This issue affects pardus-domain-joiner: before 0.5.5...
CVE-2026-15599 Arbitrary Process Termination in TÜBİTAK BİLGEM's pardus-domain-joiner
Unverified ownership vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-domain-joiner allows Privilege Abuse. This issue affects pardus-domain-joiner: before 0.5.5...
CVE-2026-15599
The CVE-2026-15599 entry concerns TÜBİTAK BİLGEM Software Technologies Research Institute’s pardus-domain-joiner (affected: before 0.5.5). The issue is described as an unverified ownership vulnerability that enables Privilege Abuse. CVSS 3.1 base score is 3.3 (LOW), with LOCAL attack vector, low ...
CVE-2026-58448 yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API
yudao-cloud before 2026.06 contains a broken access control vulnerability in the BPM module that allows any authenticated user to access arbitrary process instance records by supplying a caller-controlled process-instance identifier to an unprotected endpoint lacking the @PreAuthorize annotation...
CVE-2026-35081 Arbitrary process termination vulnerability in method ugw-logstop
The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processes due to insufficient validation of user-supplied input...
CVE-2026-35081
CVE-2026-35081 documents an Arbitrary process termination vulnerability in the ugw-logstop method. A remote attacker with user privileges can terminate arbitrary processes due to insufficient input validation. The Connected documents provide the description and CVSS metrics (CVSSv4.0 base 7.2 HIG...
Langflow 安全漏洞
Langflow is an open-source visualization framework developed by Langflow for building multi-agent and RAG applications. Langflow has a security vulnerability where authentication and authorization checks are missing for endpoints/api/v1/files/images/flowid/filename. This vulnerability allows...
GHSA-WVR4-3WQ4-GPC5 MCP Connect has unauthenticated remote OS command execution via /bridge endpoint
Summary When AUTHTOKEN and ACCESSTOKEN environment variables are not set which is the default out-of-the-box configuration the /bridge HTTP endpoint is completely unauthenticated. Any network-accessible caller can POST a request with an attacker-controlled serverPath and args payload, causing the...
EUVD-2011-1782
Malware in sbrugna...