12234 matches found
RomPager - Misfortune Cookie Detection (CVE-2014-9222)
Detects CVE-2014-9222 by sending Cookie C107373883=/ to /tr069 and matching the token plus RomPager not-found marker. !/usr/bin/env python3 -- coding: utf-8 -- """Allegro RomPager Misfortune Cookie CVE-2014-9222.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...
ColdFusion - RDS Auth Bypass Detection (CVE-2013-0632)
Detects CVE-2013-0632 by POSTing adminpassword=&rdsPasswordAllowed=1 to administrator.cfc?method=login and accessing the admin homepage. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe ColdFusion RDS auth bypass CVE-2013-0632.""" import re from kittysploit import from...
Zyxel NAS - Auth Bypass Indicator (CVE-2023-27992 family)
Detects Zyxel NAS authentication bypass via /cmd,/ck6fup6/zylogmain/configuremailsyslog, indicating exposure to the Jun/Nov 2023 vulnerability set including pre-auth command injection CVE-2023-27992 and related issues. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NAS authentication bypass...
GlassFish - Admin Console TRACE Bypass Detection (CVE-2011-1511)
Detects CVE-2011-1511 by issuing TRACE to manageUserNew.jsf and matching ConfirmPassword / NewPassword form fields. !/usr/bin/env python3 -- coding: utf-8 -- """Oracle GlassFish Admin Console TRACE auth bypass CVE-2011-1511.""" from kittysploit import from lib.protocols.http.httpclient import...
FreePBX ARI - Cookie Auth Bypass Detection (CVE-2014-7235)
Detects CVE-2014-7235 by sending crafted ariauth cookie to /recordings/index.php and matching authenticated UI markers. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX ARI recordings auth bypass CVE-2014-7235.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...
PT-2026-69776
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SCTP implementation where the auth hmacs array within struct sctp cookie is incorrectly sized. The array is intended to store a complete SCTP AUTH HMAC ALGO...
CVE-2026-68160: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: ceph: fix pre-auth out-of-bounds read on snaptrace in cephhandlecaps cephhandlecaps reads snaptracelen from the wire-format cephmdscaps header and uses it unconditionally to build a fake end pointer snaptrace + snaptracelen that ...
PT-2026-69720
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SCTP implementation where the sctp auth ep add chunkid function uses an incorrect capacity limit for the ep-auth chunk list. While the limit is set to 20 entries,...
PT-2026-69472
Name of the Vulnerable Software and Affected Versions bluewave-labs/Checkmate versions prior to 2.1.1 Description An unauthenticated remote attacker can determine if a specific email address is registered in the system. This is possible because the 'POST /api/v1/auth/recovery/request' endpoint...
CVE-2026-72588: Observable Response Discrepancy
A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code...
Joomla 2.9.99.4 - Unauthenticated Remote Code Execution
Exploit Title: Joomla 2.9.99.4 -Unauthenticated Remote Code Execution Date: 2026-07-10 Exploit Author: K3ysTr0K3R Jared Brits Vendor Homepage: https://www.joomla.org/ Software Link: https://extensions.joomla.org/extension/jce/ Version: JCE 1.0.0 through 2.9.99.4 fixed in 2.9.99.5 Tested on: Jooml...
PT-2026-69530
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the ntlm authenticate function, the destroy previous session function is called using a user pointer derived from the client-supplied NTLM blob username field before the NTLMv2 respon...
CVE-2026-19278: Permissive Regular Expression
A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine M2M token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect OIDC token, whose claim value ...
CVE-2026-72582: NULL Pointer Dereference
A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to crash the server process with a single HTTP request. The sendOTPEmail function in pkg/auth/local.go dereferences a pointer obtained from an unchecked error path without validating i...
PT-2026-69951
Name of the Vulnerable Software and Affected Versions MaaS API affected versions not specified Description A flaw in the MaaS API allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway. This occurs because the system trusts the X-MaaS-Username and X-MaaS-Group HTTP headers...
PT-2026-69466
Name of the Vulnerable Software and Affected Versions fastschema versions prior to 0.15.2 Description A NULL pointer dereference occurs when the server fails to validate that a pointer is non-nil before use. An unauthenticated remote attacker can trigger a fatal panic that crashes the server...
PT-2026-69556
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in libceph where ceph x create authorizer caches the iov base and iov len of the authorizer buffer within the ceph auth handshake structure. When ceph x update authorizer...
Linux Ceph Auth Buffer Overflow
The vulnerability of the cephhandleauthreply function in the net/ceph/auth.c module of the Linux kernel is related to the execution of operations outside of the buffer boundaries. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality and accessibility of...
Linux Distros Unpatched Vulnerability : CVE-2026-68160
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ceph: fix pre-auth out-of-bounds read on snaptrace in cephhandlecaps cephhandlecaps reads snaptracelen from the wire-format cephmdscaps header and uses it...
