Security Bulletin: IBM Cloud Pak for Data is vulnerable to OS command injection (CVE-2025-14754)

Summary IBM Cloud Pak for Data is vulnerable to OS command injection due to improper validation of user-supplied input. An authenticated remote attacker could exploit this vulnerability to execute arbitrary commands with elevated privileges on the system, potentially leading to full system...

CVE-2024-36401_Geoserver_RCE_POC

Here is the English translation of your README file: ⚠️ Disclaimer: This tool is intended solely for security research and legally authorized testing purposes. Do not use it for any illegal or unauthorized activities. The user assumes full responsibility for any legal consequences. README Version:...

rustinel

Rustinel Open-source endpoint detection. Three platforms. Your rules. Run Sigma, YARA, and IOC detections on native Windows, Linux, and macOS telemetry. Written in Rust, with local alerts and no cloud account required. Bring your detection content, monitor your endpoints, and send alerts to the...

PowerZure

For a list of functions, their usage, and more, check out https://powerzure.readthedocs.io What is PowerZure? PowerZure is a PowerShell project created to assess and exploit resources within Microsoft’s cloud platform, Azure. PowerZure was created out of the need for a framework that can both...

htcap

HTCAP htcap is a web application scanner able to crawl single page application SPA recursively by intercepting ajax calls and DOM changes. KEY FEATURES Recursive DOM crawling engine Discovers ajax/fetch/jsonp/websocket requests Supports cookies, proxy, custom headers, http auth and more Heuristic...

socbench

socbench Benchmark frontier reasoning LLMs as SOC agents on raw NetFlow data. socbench benchmarks frontier reasoning models as SOC agents: each model runs a bounded multi-turn agent loop against a deterministic, pre-indexed NetFlow corpus, with persona-scoped read-only tools, fixed dollar caps pe...

WireBug

WireBug WireBug is a tool set for Voice-over-IP penetration testing. It is designed as a wizard which makes it easy to use. The tools are build for single using too, so every tool is its own python or bash program. Installation Read the Installation Guide in the wiki. Tools FullBridge: This is a...

openvpn-install

openvpn-install OpenVPN installer for Debian, Ubuntu, Fedora, openSUSE, CentOS, Amazon Linux, Arch Linux, Oracle Linux, Rocky Linux and AlmaLinux. This script will let you setup and manage your own secure VPN server in just a few seconds. What is this? This script is meant to be run on your own...

CVE-2024-42642

CVE-2024-42642 Introduction The device in question is any MX500-series SSD. These SSDs are controlled by a Sillicon-Motion SM2259 controller older batches had an older controller, Sillicon-Motion SM2258, but the main focus of this document is the newer one. SM2259 is a 4-channel SATA 6Gb/s...

CVE-2023-4596-Vulnerable-Exploit-and-Checker-Version

CVE-2023-4596 PoC Script for CVE-2023-4596, An efficient Python tool created to perform unauthenticated Remote Command Execution via arbitrary file uploads. Resources Installation Usage Usage Installation root@kitploit: git clone...

gtfocli

GTFOcli GTFOcli it's a Command Line Interface for easy binaries search commands that can be used to bypass local security restrictions in misconfigured systems. Table of Contents Table of Contents Installation Usage Search for Unix binaries Search for Windows binaries Search using dockerized...

Cybersec

Offensive CyberSec Cheat Sheet A highly dynamic, single-file HTML cheat sheet designed for Red Teamers, Pentesters, and CTF players. Tired of typing the same Reverse Shell payloads and constantly replacing your local IP and port? This tool eliminates the "Typo Fatigue" and cognitive load during...

goLoL

goLoL goLoL is a Windows host scanner with dual support for LOLBAS binaries and LOLDrivers. It lists LOLBAS techniques runnable at your current privilege level with MITRE ATT&CK mappings and can scan local .sys files for vulnerable/malicious LOLDrivers hash matches. Note: This is not an OPSEC saf...

AgentWard

AgentWard · 玄甲OS AgentWard 玄甲 is a full-stack security operating system purpose-built for trustworthy, scalable AI agent deployment, with native code adaptation to OpenClaw. AgentWard unifies agent onboarding, secure reasoning, and trusted execution in one cohesive security architecture, with...

dcsgonefirm

dcsgonefirm Notes As this repo is still being worked on, some things in this Readme are marked with 'Dev:'. Feel free to change this if needed. Building this You need ESP-IDF, any modern version should work. Dev: Change this if you require a more specific version Command-line: root@kitploit: idf....

CSSG

CSSG Cobalt Strike Shellcode Generator Ryan Stephenson RCStep Adds Shellcode - Shellcode Generator to the Cobalt Strike top menu bar CSSG is aggressor, .NET, and python scripts used to more easily generate and format beacon shellcode Generates beacon stageless shellcode with exposed exit method,...

intentshield

IntentShield Don't filter what your AI says. Filter what it's about to do Pre-execution intent verification for AI agents. Why This Exists AI agents have tool access. They can execute shell commands, write files, browse URLs, send emails, and call APIs. Every one of those actions is a potential...

K55

K55 - Linux x8664 Process Injection Utility C++14 About K55 pronounced: "kay fifty-five" The K55 payload injection tool is used for injecting x8664 shellcode payloads into running processes. The utility was developed using modern C++11 techniques as well as some traditional C linux functions like...

agartha

Agartha Payload Injection LFI, RCE, SQLi, with optional BCheck, Auth Issues Access Matrix, HTTP 403, Copy as JavaScript, and Bambdas Agartha, specializes in advance payload generation and access control assessment. It adeptly identifies vulnerabilities related to injection attacks, and...

cve-2022-29464

cve-2022-29464 Disclaimer root@kitploit: 脚本仅供学习参考，请勿恶意攻击他人网站 如违法乱纪，造成一切后果由使用者自行承担 技术无罪，与作者无关 使用脚本默认同意以上说明！ --Author:lowkey0808 Usage root@kitploit: usage: python3 -u url cve-2022-29464 optional arguments: -h, --help show this help message and exit -u 目标url -s 上传的木马,默认上传内置shell.jsp Direct command...