132 matches found
Apache-CVE-2021-42013-RCE-Exploit
🚀 Descripción general Esta herramienta de explotación apunta a vulnerabilidades de path traversal y ejecución remota de código en Apache HTTP Server versiones 2.4.49 y 2.4.50. La herramienta utiliza el backend de curl para evitar los problemas de codificación de URL que afectan a otros intentos d...
apache-cve-2021-42013-lab
Apache HTTP Server 2.4.49 Path Traversal y Ejecución Remota de Código CVE-2021-42013 Sobre el Proyecto En este proyecto mostré la vulnerabilidad CVE-2021-42013 presente en Apache HTTP Server 2.4.49 en un entorno de laboratorio que creé usando Docker. El objetivo es examinar en un entorno controla...
cve-2021-41773-docker-lab
Laboratorio CVE-2021-41773 Laboratorio en contenedor para jugar/aprender con CVE-2021-41773 Divulgación de archivos: $ docker build -t apache-default defaultconf $ docker run -dit --name apache-app -p 81:80 apache-default PoC curl -s --path-as-is...
CVE-2021-41773
Reproducción de CVE-2021-41773 https://www.tenable.com/blog/cve-2021-41773-path-traversal-zero-day-in-apache-http-server-exploited v2.4.49 es una vulnerabilidad exclusiva de Apache. En versiones anteriores no existía la función apnormalizepath, que fue introducida en la versión v2.4.49...
CVE-2024-4577-EXPLOIT
CVE-2024-4577 - Inyección de Argumentos en PHP CGI - Ejecución Remota de Código RCE En ciertas versiones de PHP 8.1. anteriores a 8.1.29, 8.2. anteriores a 8.2.20 y 8.3. anteriores a 8.3.8, existe una vulnerabilidad crítica cuando se utiliza PHP con Apache y PHP-CGI en Windows. Si el sistema está...
CVE-2021-41773
CVE-2021-41773 Apache HTTP服务器漏洞（仅影响2.4.49版本） 需求设置 httpd.conf ... LoadModule cgimodule modules/modcgi.so 取消注释这一行 ... AllowOverride none Require all denied 注释掉这一行或设置为Require all granted ... 参考 https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773/rapid7-analysis...
CVE-2026-51723
Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to install a custom CGI module via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51723
Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to install a custom CGI module via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
EUVD-2026-68672
Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to install a custom CGI module via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
PT-2026-83927
Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to install a custom CGI module via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51723
Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to install a custom CGI module via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51723: Improper Access Control
Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to install a custom CGI module via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51723
The TOTOLINK T6 wireless dual-band Mesh router (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw within the UploadCustomModule function. This vulnerability allows unauthenticated attackers to install a custom CGI module by sending a specially crafted POST...
Exploit for Path Traversal in Apache Http_Server
CVE-2021-42013 — PoC: Path Traversal + RCE via modcgi bypass...
Exploit for Path Traversal in Apache Http_Server
CVE-2021-41773 — PoC: Path Traversal + RCE via modcgi So...
CLSA-2026-1778535928 python: Fix of 2 CVEs
CVE-2021-3733: fix ReDoS in urllib2 AbstractBasicAuthHandler regex; the legacy '?:.,' prefix is replaced with the upstream-3.x form '?:^|,' and the scheme charset excludes ',' to prevent quadratic backtracking on crafted WWW-Authenticate headers - CVE-2021-23336: stop accepting ';' as a default...
MiracleLinux 4 : perl-5.10.1-130.AXS4 (AXSA:2013-320:01)
The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2013-320:01 advisory. Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at handling processes and files, and is...
MiracleLinux 4 : perl-5.10.1-119.AXS4 (AXSA:2011-570:01)
The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2011-570:01 advisory. Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at handling processes and files, and is...
httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...
A server side include handling flaw has been discovered in the Apache HTTP server. When Server Side Includes SSI areenabled and modcgid but not modcgi passes the shell-escaped query string to exec cmd="..." directives an attacker may be able to inject commands executed by the server...