The vulnerability of the Rsync file transfer and synchronization utility, related to bypassing authentication through spoofing, allows a perpetrator to circumvent existing security mechanisms.

The vulnerability of the Rsync file transfer and synchronization utility relates to the bypassing of authentication processes through spoofing. Exploiting this vulnerability allows a malicious actor to circumvent existing security mechanisms remotely...

RHEL 10 : tomcat9 (RHSA-2026:68651)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68651 advisory. Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages...

The vulnerability of the Microsoft Authentication Library (MSAL), related to the possibility of bypassing the authentication process, allows attackers to perform spear-phishing attacks.

The vulnerability of the Microsoft Authentication Library MSAL relates to the possibility of bypassing the authentication process. Exploiting this vulnerability could allow a malicious actor to perform spear-phishing attacks remotely...

Oracle Linux 8 : tomcat (ELSA-2026-68677)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-68677 advisory. - Resolves: RHEL-192806 HTTP/2 request headers not validated CVE-2026-41293 - Resolves: RHEL-219561 Security constraint bypass via improper URL encodi...

AlmaLinux 8 : tomcat (ALSA-2026:68677)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:68677 advisory. tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43512 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not...

tomcat9 security update

1:9.0.120-1 - Resolves: RHEL-192649 Tomcat9: Improper Input Validation vulnerability due to incomplete fix CVE-2026-32990 - Resolves: RHEL-192818 Tomcat9: HTTP/2 request headers not validated CVE-2026-41293 - Resolves: RHEL-219582 Tomcat9: Insufficient documentation for EncryptInterceptor may lea...

Oracle Linux 10 : tomcat9 (ELSA-2026-68651)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-68651 advisory. - Resolves: RHEL-192649 Tomcat9: Improper Input Validation vulnerability due to incomplete fix CVE-2026-32990 - Resolves: RHEL-192818 Tomcat9: HTTP/2...

Exch-CVE-2021-26855

Exch-CVE-2021-26855 ProxyLogon is the formally generic name for CVE-2021-26855, a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin. We have also chained this bug with another post-auth arbitrary-file-write vulnerability...

hikvision_CVE-2017-7921_auth_bypass_config_decryptor

hikvisionCVE-2017-7921authbypassconfigdecryptor This python file will decrypt the configurationFile used by hikvision cameras vulnerable to CVE-2017-7921. https://www.checkpoint.com/defense/advisories/public/2017/cpai-2017-0876.html/ Description Hikvision IP Cameras Authentication Bypass...

CVE-2025-8730

CVE-2025-8730 – Authentication Bypass in Belkin F9K1009/F9K1010 Author : Byte Reaper Description : This repository contains a exploit for CVE‑2025‑8730, a critical Authentication Bypass vulnerability affecting the web interface of Belkin F9K1009 and F9K1010 routers. The flaw lies in the session...

hunt-for-cve-2018-10933

搜寻并利用 libSSH 身份验证绕过漏洞 CVE-2018-10933 实用指南，讲解如何发现受 libSSH 身份验证绕过漏洞 CVE-2018-10933 影响的主机，以及如何利用该漏洞获取 Shell 访问权限。 请参阅以下博文获取操作说明：https://www.marcolancini.it/2018/blog-libssh-auth-bypass/...

CVE-2022-46169

CVE-2022-46169 该仓库包含 CVE-2022-46169 的概念验证（PoC）代码——通过组合认证绕过与命令注入实现 Cacti = 1.2.22 的未授权远程代码执行，Sonar 在这篇博客文章中对此进行了描述。相同的漏洞也由 Source Incite 的 Steven Seeley mrme 独立发现。 用法： root@kitploit: 位置参数： target Cacti 应用的 URL。 可选参数： -f FILE 包含命令的文件 -c CMD 命令 --nhostids 尝试的 hostid 范围（0 - n） --nlocaldataids 尝试的...

CVE-2019-6340-Drupal-8.6.9-REST-Auth-Bypass

CVE-2019-6340 / SA-CORE-2019-003 Se incluyen tres scripts para demostrar cómo Drupal 8.6.9 es vulnerable a CVE-2019-6340: createnodeviarest.py - Ejemplo de creación normal de nodo autenticado con la API REST doesnotcorrespond.py - Demostración de que la solicitud se procesa incluso sin...

ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend

ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend TL;DR Oye, en este laboratorio de LetsDefend me sumergí en un zero‑day de SharePoint llamado ToolShell CVE‑2025‑53770. Básicamente, simulé un ataque real donde una petición POST maliciosa eludió la autenticación, ejecutó PowerShell para...

CVE-2026-77903

Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-69843

Microsoft Fabric is affected by an authentication bypass by spoofing vulnerability that allows an unauthorized, unauthenticated attacker to elevate privileges over a network. The flaw carries a CVSS 3.1 score of 10.0 (Critical) with a changed scope and high impact to confidentiality, integrity, a...

CVE-2026-77903

Microsoft Dataverse is affected by an authentication bypass by spoofing vulnerability that allows an unauthorized, remote attacker to elevate privileges over a network. The CVSS 3.1 score is 9.0 (CRITICAL) , with a vector of AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating high attack complexity b...

CVE-2017-12542-Exploit

Bypass de autenticación de HP iLO CVE-2017-12542 Este repositorio contiene un exploit de prueba de concepto para CVE-2017-12542 , una vulnerabilidad de bypass de autenticación que afecta a ciertas versiones del firmware de HP Integrated Lights-Out iLO. La vulnerabilidad permite acceso no...

CVE-2026-76949

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for the attacker's own account...

CVE-2026-76949 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for the attacker's own account...