CVE-2024-50379-POC

CVE-2024-50379 Exploitation und POC Dieses Repository enthält einen Proof of Concept POC für CVE-2024-50379 , eine Sicherheitslücke, die Apache Tomcat betrifft. Das Problem beinhaltet eine Time-of-Check-Time-of-Use TOCTOU Race-Condition , die zu Remote Code Execution RCE führen kann, insbesondere...

cve-2024-32002-poc-rce

CVE-2024-32002 RCE POC Ein POC für CVE-2024-32002, der Remote Code Execution RCE demonstriert. Siehe cve-2024-32002-poc-rce für das zugehörige Submodul-Repository. Was dieses Repository enthält Ein Symlink mit einem beliebigen Namen, der auf das .git-Verzeichnis verweist. Eine .gitmodules-Datei,...

CVE-2025-27636-Practical-Lab

🛡️ CVE-2025-27636 — Praktisches Exploitation-Labor für Apache Camel 🔍 Übersicht CVE-2025-27636 ist eine kritische Remote-Codeausführung RCE -Schwachstelle in Apache Camel , insbesondere in der Komponente camel-exec. Sie beruht auf einem subtilen, aber gefährlichen Problem:...

CVE-2021-21300

CVE-2021-21300 In mehreren Git-Versionen wird die Verarbeitung von symbolischen Links Symlinks nicht streng gehandhabt. Wenn Dateien auf einem Dateisystem, das zwischen Groß- und Kleinschreibung unterscheidet z. B. Linux, in Git hochgeladen werden und dann ein Host mit einem Dateisystem, das nich...

running-CVE-2024-32002-locally-for-tesing

हम इसे स्थानीय उपयोग के लिए अनुकूलित कर रहे हैं हम इस ब्लॉग पोस्ट का अनुसरण कर रहे हैं लेकिन कुछ प्रमुख अंतरों के साथ https://amalmurali.me/posts/git-rce यह कैसे काम करता है 1. एक दुर्भावनापूर्ण रिपॉजिटरी gitrce में एक विशेष रूप से तैयार पथ वाला एक सबमॉड्यूल शामिल है। 2. सबमॉड्यूल पथ एक केस वेरिए...

git_rce

CVE-2024-32002: Sfruttare RCE in Git tramite git clone Questo repository contiene un PoC per sfruttare CVE-2024-32002, una vulnerabilità in Git che consente RCE durante un'operazione di git clone. Creando repository con sottomoduli in modo specifico, un attaccante può sfruttare la gestione dei...

psudohash

psudohash Cool New Features of v1.1.0 Special thanks to DavidAngelos: ▶️ Added a progress bar in every step to track execution. ▶️ Added options: In-order joins -i / --inorder: join keywords only in the original order e.g. foo,bar,baz → foo, bar, baz, foobar, foobaz, barbaz, foobarbaz. All-order...

CVE-2024-32002

PoC per CVE-2024-32002, lo script creato dal caso di test dello sviluppatore: https://github.com/git/git/commit/97065761333fd62db1912d81b489db938d8c991ddiff-2ba261bbd9de8e881d700e696eebab0df581473ba50b671b2cbe4bbee5ca87b0 Questo software è stato creato esclusivamente per scopi di ricerca accademi...

CVE-2024-32002

CVE-2024-32002: Ausnutzung von Git RCE mittels git clone Dieses Repository enthält einen PoC zur Ausnutzung von CVE-2024-32002, einer Schwachstelle in Git, die RCE während eines git clone-Vorgangs ermöglicht. Durch das spezielle Erstellen von Repositories mit Submodulen kann ein Angreifer die...

CVE-2023-25202

CVE-2023-25202: Meccanismo di caricamento file insicuro Descrizione La CVE-2023-25202 riguarda un meccanismo di caricamento file insicuro all'interno dell'applicazione Therefore, eccessivamente permissivo nei tipi di file che gli utenti possono caricare. L'applicazione blocca solo i caricamenti d...

git_rce

Attacco di Remote Code Execution tramite git clone CVE-2024-32002 Contributore Jeongwoo Lee @Roronoawjd Contesto Questa vulnerabilità è una RCE Remote Code Execution che si verifica quando si clona un repository Git che contiene sottomoduli su file system che non fanno distinzione tra maiuscole e...

Gotenberg <= 8.30.1 - Server Side Request Forgery

Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression ^https?:// to match URL schemes. Because Go's net/url.Parse normalizes...

DEBIAN-CVE-2026-78959

Improper handling of case sensitivity in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-78959

Improper handling of case sensitivity in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-78959

Google Chrome prior to 152.0.7977.65 contains a vulnerability in the FileSystem component caused by improper handling of case sensitivity . A remote attacker, leveraging social engineering , can bypass system access restrictions by delivering a crafted HTML page. The Chromium security severity is...

rosenbridge

project:rosenbridge : hardware backdoors in x86 CPUs github.com/xoreaxeaxeax/rosenbridge // domas // @xoreaxeaxeax Overview project:rosenbridge reveals a hardware backdoor in some desktop, laptop, and embedded x86 processors. The backdoor allows ring 3 userland code to circumvent processor...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

BIT-KEYCLOAK-2026-9086 Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass

A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with manage-client permission or access to client registration endpoints, could bypass client Uniform Resource Identifier URI validation. This is achieved by registering a malicious client with a...

CVE-2026-59335

Improper handling of case sensitivity CWE-178 in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to bypass the intended restriction that this authority does not grant access to t...

CVE-2026-59335 Case-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA Compromise

Improper handling of case sensitivity CWE-178 in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to bypass the intended restriction that this authority does not grant access to t...