CVE-2026-53576

Exploit RCE non autenticato Kestra CVE-2026-53576 Bypass critico dell'autenticazione che consente l'esecuzione di codice remoto non autenticata Exploit • Dettagli della vulnerabilità • Impatto • Rimedi ⚠️ DISCLAIMER Questo strumento è destinato esclusivamente a test di sicurezza educativi e...

Yamcs has Unauthenticated Directory Traversal

Attack type: Unauthenticated remote Impact: Attackers can access any system files from the underlying host. Affected components: HttpRequestHandler.java, StaticFileHandler.java An Unauthenticated Directory Traversal vulnerability exists in Yamcs Steps to Reproduce: 1. Start Yamcs and login as a...

GHSA-9JG3-G3WH-W9PJ Yamcs has Unauthenticated Directory Traversal

Attack type: Unauthenticated remote Impact: Attackers can access any system files from the underlying host. Affected components: HttpRequestHandler.java, StaticFileHandler.java An Unauthenticated Directory Traversal vulnerability exists in Yamcs Steps to Reproduce: 1. Start Yamcs and login as a...

Yamcs has Reflected XSS in the URL of the Authorize Endpoint

Attack type: Unauthenticated remote Impact: Attackers can execute arbitrary JavaScript in a user's browser, including obtaining a user's session token and refresh token. Affected components: authorize.html, AuthHandler.java, HandlerContext.java A Reflected Cross-Site Scripting vulnerability...

GHSA-RXPG-WJF8-QV9C Yamcs has Reflected XSS in the URL of the Authorize Endpoint

Attack type: Unauthenticated remote Impact: Attackers can execute arbitrary JavaScript in a user's browser, including obtaining a user's session token and refresh token. Affected components: authorize.html, AuthHandler.java, HandlerContext.java A Reflected Cross-Site Scripting vulnerability...

ACF

Android Connections Forensics Questo software consente a un investigatore forense di associare ogni connessione al processo che la ha originata. Non richiede privilegi di root sul sistema, ma richiede adb e il debug USB. Sistemi operativi supportati ACF attualmente funziona solo su Linux Ubuntu...

I-know-where-your-page-lives

I-know-where-your-page-lives I Know Where Your Page Lives: derandomizzare il kernel di Windows 10 più recente - ZeroNights 2016 Requisiti Processore Intel Haswell o successivo Windows 10 x64 Uso Esegui ASLRSideChannelAttack.exe per ottenere l'entry PML4-Self-Ref...

GHSA-8XJQ-PR36-CCGF Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets

Summary The PacketsApi.exportPackets endpoint in Yamcs fails to properly enforce object-level privileges ReadPacket when an API request omits specific packet names. As a result, an attacker with a low-privileged account or any authenticated user with zero privileges can dump the entire archive of...

Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets

Summary The PacketsApi.exportPackets endpoint in Yamcs fails to properly enforce object-level privileges ReadPacket when an API request omits specific packet names. As a result, an attacker with a low-privileged account or any authenticated user with zero privileges can dump the entire archive of...

Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication

Malicious actors are exploiting a newly patched security flaw in PaperCut NG and MF to execute arbitrary code on susceptible instances, as the company released a fresh emergency fix with additional hardening. "This vulnerability gives an unauthenticated attacker remote control over PaperCut's...

acunetix_0day

Acunetix 0day RCE - SYSTEM Acunetix 0day RCE Verwendung Führe das Skript mit aus root@kitploit: dzonerzy:dvm dzonerzy$ python /Users/dzonerzy/PycharmProjects/natbypass/acu0day.py 9999 172.16.24.1 Acunetix WVS 10 - SYSTEM Remote Command Execution Daniele Linguaglossa Payload: Meterpreter reverse T...

GHSA-3G44-3M7X-CGG2 Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

Overview Yamcs compiles StreamSQL expressions to Java on the fly with the Janino SimpleCompiler no restrictive class-loading policy or expression sandbox. When a StreamSQL aggregate such as sum... is applied to a column, the column's name is interpolated unescaped into the generated Java source...

Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

Overview Yamcs compiles StreamSQL expressions to Java on the fly with the Janino SimpleCompiler no restrictive class-loading policy or expression sandbox. When a StreamSQL aggregate such as sum... is applied to a column, the column's name is interpolated unescaped into the generated Java source...

CVE-2023-6241

Exploit per CVE-2023-6241 Il write-up si trova qui. Si tratta di un bug nel driver del kernel Arm Mali che ho segnalato a novembre 2023. Il bug può essere utilizzato per ottenere l'esecuzione arbitraria di codice nel kernel dal dominio delle app non fidate, che viene poi usato per disabilitare...

Malicious code in calcboxlite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 227fe04d85516bd5348dea2c0c25078d057eacb4f439fd6a241ea0409b7afd09 setup.py and calcboxlite/init.py both invoke a top-level report function that reads getpass.getuser and socket.gethostname and POSTs them as JSON to ...

MAL-2026-15488 Malicious code in calcboxlite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 227fe04d85516bd5348dea2c0c25078d057eacb4f439fd6a241ea0409b7afd09 setup.py and calcboxlite/init.py both invoke a top-level report function that reads getpass.getuser and socket.gethostname and POSTs them as JSON to ...

EUVD-2026-67835

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/nfInstanceID accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or...

CVE-2026-55068 free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/nfInstanceID accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or...

CVE-2026-55068 free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/nfInstanceID accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or...

CVE-2026-55068

free5GC (open-source 5G core network) version 4.2.2 and earlier is vulnerable to NF Registration Poisoning in the NRF component. The RegisterNFInstance handler (PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID}) accepts NF profile bodies without enforcing 3GPP TS 29.510 constraints for UUID format, nf...