cve-2017-5123

CVE-2017-5123 Questa repository contiene una dimostrazione di CVE-2017-5123 , un backdoor di comando e controllo via ICMP, e un'applicazione web vulnerabile CWE-78 OS Command Injection. Parte di CSC 4308 - Challenge 3. Prerequisiti Linux Kernel : dalla 4.13 fino alla ma esclusa 4.13.7 Node.js :...

Security update for rsyslog

This update for rsyslog fixes the following issue: Heap buffer overflow in the core RainerScript replace function bsc1275926. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the comma...

Security update for rsyslog

This update for rsyslog fixes the following issue: Heap buffer overflow in the core RainerScript replace function bsc1275926. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the comma...

CVE-2020-14882

CVE-2020-14882 CVE-2020-14882/14883/14750 USO 1. clone este repositório 2. instale a biblioteca requests 3. python3 14882.py EXEMPLO root@kitploit: λ python3 14882.py -u http://...:7001 -c whoami + Command success result: win-t63ko18er74\administrator referência...

CVE-2023-33869-RCE-PoC

Center for Energy Security and Reliability - UNC Charlotte CVE-2023-33869 ist eine Command-Injection-Sicherheitslücke, die die Firmware-Version D7.0.88 des Enphase Envoy betrifft. Diese Schwachstelle ermöglicht es einem Angreifer, beliebige Befehle mit Root-Rechten auf dem betroffenen Gerät...

nopowershell

NoPowerShell NoPowerShell è uno strumento implementato in C che supporta l'esecuzione di comandi simili a quelli di PowerShell rimanendo invisibile a qualsiasi meccanismo di logging di PowerShell. Questo binario compatibile con .NET Framework 2 può essere caricato in Cobalt Strike per eseguire...

WordPress Bit File Manager plugin < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch vulnerability

Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch vulnerability discovered by Artus KG in WordPress Plugin Bit File Manager versions 6.9.1...

CVE-2021-32162

..| CSRFtoCommandInjection2 |.. Descrizione : Sfruttare un attacco Cross-site request forgery CSRF per ottenere una Command Injection tramite la funzionalità File Manager di Webmin Versione testata : Webmin 1.973 ultima versione su GitHub 07/03/2021 Tipo di attacco: Remoto Impatto : Esecuzione di...

CVE-2021-32158

..| XSStoCommandInjection1 |.. Descrizione : Sfruttare un attacco di Cross-Site Scripting XSS riflesso per ottenere una Command Injection tramite la funzionalità Upload e Download di Webmin Versione Testata : Webmin 1.973 ultima versione di GitHub 07/03/2021 Tipo di Attacco: Remoto Impatto :...

CVE-2021-32156

..| CSRF to RCE CRON |.. Descrizione : Sfruttare un attacco di Cross-site request forgery CSRF per ottenere una Remote Command Execution RCE tramite la funzionalità Scheduled Cron Jobs di Webmin Versione testata : Webmin 1.973 ultima versione di GitHub 07/03/2021 Tipo di attacco: Remoto Impatto :...

CVE-2021-31761

..| CVE-2021-31761 |.. Beschreibung : Ausnutzen eines reflektierten Cross-Site-Scripting-Angriffs XSS, um über die Funktion für laufende Prozesse von Webmin eine Remote Command Execution RCE zu erreichen Getestete Version : Webmin 1.973 die neueste GitHub-Version 07/03/2021 Angriffstyp: Remote...

CVE-2021-31760

..| CVE-2021-31760 |.. Descrizione : Sfruttare un attacco Cross-site request forgery CSRF per ottenere una Remote Command Execution RCE attraverso la funzione di processo in esecuzione di Webmin Versione testata : Webmin 1.973 ultima versione su GitHub 07/03/2021 Tipo di attacco: Remoto Impatto :...

Ashwesker-CVE-2025-64155

🔒 CVE-2025-64155: Kritische FortiSIEM-Sicherheitslücke 📌 Übersicht CVE-2025-64155 ist eine kritische Sicherheitslücke in Fortinet FortiSIEM , einer beliebten Plattform für Security Information and Event Management SIEM. Die am 13. Januar 2026 öffentlich bekannt gegebene Schwachstelle ermöglicht e...

secure-by-default-rce-demo

Mitigazione RCE in Node.js: il DevOps come ultima linea di difesa Questo progetto dimostra una vulnerabilità critica di Remote Code Execution RCE in un'applicazione Next.js in particolare tramite Server Actions e come l'indurimento dell'infrastruttura neutralizzi efficacemente l'attacco anche...

DEBIAN-CVE-2026-42392

An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH...

ALPINE-CVE-2026-42391

An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by...

CVE-2026-42392

An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH...

DEBIAN-CVE-2026-42391

An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by...

ALPINE-CVE-2026-42392

An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH...

CVE-2026-42391

An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by...