github-dorks

Github Dorks Github Search is a quite powerful and useful feature that can be used to search for sensitive data on repositories. Collection of Github dorks can reveal sensitive personal and/or organizational information such as private keys, credentials, authentication tokens, etc. This list is...

CVE-2017-9779

通过路径用户从Windows自动执行Payload :: 什么是Cmder？ Cmder是一个软件包，创建它的纯粹原因是Windows上缺乏好用的控制台模拟器。它基于优秀的软件，并加入了Monokai色彩方案和自定义提示布局，从一开始就看起来很性感。 Cmder网站框架！ http://cmder.net/ 什么是.bashrc 是可执行文件。您编写的任何单词都会直接显示在终端上。不幸的是，对于所有Linux系统，它都适用于所有它们。 Windows中的Users是什么？ 是用户基本文件后面的文件，适用于Windows的说明性图片。 | 视频...

CVE-2017-4490-install-Script-Python-in-Terminal-

CVE-2017-4490-在终端中安装脚本Python- 什么是CVE-2017-4490 后渗透，== 来吧，我的漏洞利用想法，.bashrc在使用许多有害的想法 1. 在终端中使用.bashrc安装Script脚本webdeilvary 2. 在终端中销毁并显示恐怖文本 3. 颠覆并无法重新打开终端 下载脚本安装脚本webdeilvary git clone...

CVE-2017-4490-

CVE-2017-4490 我做了一些实验，成功利用了 .basgrc 文件，该文件专门用于在终端上书写和装饰。我在 .bashrc 文件中创建了一个漏洞，并成功阻碍了终端。我发现的这个漏洞适用于所有 Linux 系统，因为 figlet 适用于所有系统。 只需输入命令 apt-get install figlet 你就会在 Home 或 root 下生成 .bashrc。 删除 .bashrc 文件不需要任何权限。 然后添加一个 经过你修改并植入漏洞的 .bashrc。...

CVE-2018-17961

构建镜像 使用端口转发运行容器 通过 ssh -X 进入其中 运行 evince executeonlybypass.ps 检查漏洞利用是否已写入 /.bashrc...

PYSEC-2026-2615 Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite

Impact What kind of vulnerability is it? Who is impacted? Receiving a file wormhole receive from a malicious party could result in overwriting critical local files, including /.ssh/authorizedkeys and .bashrc. This could be used to compromise the receiver's computer. Only the sender of the file th...

MAL-2026-10066 Malicious code in nps-retrieval-diagnostics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d9521917c225941dd1bfc038c4f324d24ebb9d99b99596e8a481558da10a0df The package's bin entry retrieval-diagnostics installs an attacker-controlled persistence footprint on the host when invoked. It appends a crontab...

MAL-2026-6230 Malicious code in django-auth-middleware-plus (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cf58978ba5eec5220b4b4d85966efff31d31d164ff103f98dfd627381e061ec On import, djangoauthmiddlewareplus/init.py spawns a daemon thread that POSTs a JSON payload containing the host's hostname, username, cwd, environme...

MAL-2026-5519 Malicious code in requests-toolbelt-plus (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38c64ca050de4910f56bc4a652890b0a378082859cb62153762c6ae08b4b8eae The package impersonates the popular requests-toolbelt library but ships an empty requeststoolbeltplus/init.py and places its real logic in setup.py...

CVE-2026-52755 Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Import

Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that allows attackers to write files outside the intended theme directory. Attackers can craft malicious theme ZIP files with traversal sequences in filenames to execute arbitrary code or modify sensiti...

EUVD-2026-36014

Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that allows attackers to write files outside the intended theme directory. Attackers can craft malicious theme ZIP files with traversal sequences in filenames to execute arbitrary code or modify sensiti...

PT-2026-48415

Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that allows attackers to write files outside the intended theme directory. Attackers can craft malicious theme ZIP files with traversal sequences in filenames to execute arbitrary code or modify sensiti...

Quasar Linux RAT Steals Developer Credentials for Software Supply Chain Compromise

A previously undocumented Linux implant codenamed Quasar Linux RAT QLNX is targeting developers' systems to establish a silent foothold as well as facilitate a broad range of post-compromise functionality, such as credential harvesting, keylogging, file manipulation, clipboard monitoring, and...

OSEC-2026-03 opam install sandbox escape

Summary .install files do not validate whether they are inside the package area, and so can bypass sandboxing. Exploit In a package.install file, this installs a file as /.bashrc: bin: "payload.sh" "../../../.bashrc" Timeline - 2026-04-11: Anil forwarded the issue from Andrew Nesbitt to the OCaml...

CVE-2026-32116

Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. From 0.21.0 to before 0.23.0, receiving a file wormhole receive from a malicious party could result in overwriting critical local files, including /.ssh/authorizedkeys and .bashrc. This cou...

EUVD-2026-11643

Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite...

Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite

Impact What kind of vulnerability is it? Who is impacted? Receiving a file wormhole receive from a malicious party could result in overwriting critical local files, including /.ssh/authorizedkeys and .bashrc. This could be used to compromise the receiver's computer. Only the sender of the file th...

UBUNTU-CVE-2026-32116

Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. From 0.21.0 to before 0.23.0, receiving a file wormhole receive from a malicious party could result in overwriting critical local files, including /.ssh/authorizedkeys and .bashrc. This cou...

CVE-2026-32116 Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite

Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. From 0.21.0 to before 0.23.0, receiving a file wormhole receive from a malicious party could result in overwriting critical local files, including /.ssh/authorizedkeys and .bashrc. This cou...

CVE-2026-32116

Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. From 0.21.0 to before 0.23.0, receiving a file wormhole receive from a malicious party could result in overwriting critical local files, including /.ssh/authorizedkeys and .bashrc. This cou...