UEFI-Security-Research-Howyar-SysReturn-NetCopy

🌊 UEFI Security Research - Howyar SysReturn NetCopy Under the cloak of Secure Boot, some architectures sink deeper than the vulnerabilities that exposed them. Some binaries are revoked. Some patches are shipped. But deep below the surface, old habits leave traces. This is what remains when a...

cve-2026-22732-poc

CVE-2026-22732 — Proof of Concept Spring Security silently drops HTTP response security headers. Demo / educational use only; run it against nothing but this local app. | ---|--- CVE| CVE-2026-22732 CWE-425, published 2026-03-19 CVSS 3.1| 9.1 CRITICAL — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Direct...

DFRoot

DFRoot — SM-S938B Galaxy S25 Ultra Port · Fast Channel + Manual A fork of diabl0w/DFRoot, specifically ported for the Samsung Galaxy S25 Ultra SM-S938B / pa3q , with the UI and runtime output entirely in Chinese. Two chains, one interface: Method| Vulnerability| Characteristics ---|---|--- Fast...

CVE-2026-97876

A flaw was found in GRUB2. The bootloader insufficiently validates memory addresses passed to the serial configuration command, allowing arbitrary system memory to be targeted instead of a legitimate serial communication device. A local attacker with control over GRUB's boot configuration can...

DEBIAN-CVE-2026-97876

A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation of the MMIO base address passed to th...

CVE-2026-97876

A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation of the MMIO base address passed to th...

CVE-2026-97876

A flaw in GRUB2 allows a local attacker with control over the boot configuration to bypass Secure Boot lockdown restrictions. The root cause is the insufficient validation of the MMIO base address passed to the serial command; GRUB fails to verify that the address corresponds to a legitimate UART...

CVE-2026-97876 Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base address

A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation of the MMIO base address passed to th...

CVE-2026-97876 Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base address

A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation of the MMIO base address passed to th...

EUVD-2026-91376

A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation of the MMIO base address passed to th...

am335xbootrom

Reverse Engineering the AM335x Boot ROM It's probably been eighteen months since I first got my hands a few Beaglebone Black boards, saved from the dumpster. Unfortunately, the boards didn't work right away. Now, this was my first time working with one of these boards, or any single board compute...

CVE-2022-22965-rexbb

CVE-2022-22965-rexbb SpringBoot Core command execution vulnerability. CVE-2022-22965 exploitation tool, developed based on JavaFx, making graphical operation simpler and improving efficiency. December 28, 2022 - Wednesday - 21:44 I have been doing vulnerability reproduction these days and suddenl...

TPASLog4ShellPoC

TPAS Log4Shell PoC This repository contains a Proof of Concept PoC for the Log4Shell vulnerability CVE-2021-44228, developed as part of the coursework for the curricular unit TPAS in the Master's degree in Information Security at FCUP. It features: A React SPA frontend that simulates a generic...

Linux Distros Unpatched Vulnerability : CVE-2026-97876

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while...

log4j2-test

Log4j2 2.14.1 LDAP Remote Code Execution Vulnerability CVE-2021-44228 Verification 🎈 Tested on Spring Boot 2.x environment Vulnerability advisory https://nvd.nist.gov/vuln/detail/CVE-2021-44228 target-server pom.xml : Downgraded Log4j2 version to a vulnerable version 17 2.14.1 LoggingController :...

test_avb_key

On Almost Signing Android Builds Introduction An error sometimes encountered by NCC Group consultants is signing Android builds with known private keys. This leaves the device manufacturers and in turn their users vulnerable, even on devices where secure boot is enabled. This blog post has two...

EUVD-2026-91060

Kasa EC70 v4 and EC71 v4 do not logically disable the production debug interface at the firmware or chip level and do not lock the bootloader. Although the debug traces are physically severed during manufacturing, an attacker with physical access can restore the connection, interrupt the boot...

CVE-2026-79298

🐞 CVE-2026-79298: Incomplete Remediation of UEFI Secure Boot Bypass in Howyar SysReturn A vulnerability was patched. A binary was revoked. But only half the architecture was fixed. Eighteen months later, the IA-32 boot path still carried the same custom PE loader, the same bypassed Secure Boot...

LogoFail-PoC

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ BIOS Image Parser...

yaml-payload-2

yaml-payload Un payload de explotación de deserialización de SnakeYAML para CVE-2022-1471 , adaptado de artsploit/yaml-payload originalmente basado en mbechler/marshalsec. Qué hace Cuando se carga mediante el inseguro Yaml.load de SnakeYAML, este payload toma el control de la aplicación en...