CVE-2019-0708

CVE-2019-0708 CVE-2019-0708 python3 check 0708 远程桌面服务（曾用名：终端服务）中存在一个远程代码执行漏洞，当未经身份验证的攻击者通过RDP连接到目标系统并发送特制请求时，即可触发此漏洞。此漏洞存在于身份验证之前，无需用户交互。成功利用此漏洞的攻击者可在目标系统上执行任意代码。攻击者可随后安装程序；查看、更改或删除数据；或创建具有完全用户权限的新账户。 要利用此漏洞，攻击者需要通过RDP向目标系统的远程桌面服务发送特制请求。该更新通过修正远程桌面服务处理连接请求的方式来修复此漏洞。...

webp_server_go 0.4.0 - Path Traversal

webpservergo 0.4.0 contains a path traversal caused by insufficient sanitization in file handling, letting attackers read arbitrary files on the server, exploit requires attacker to send crafted requests. id: CVE-2021-46104 info: name: webpservergo 0.4.0 - Path Traversal author: pikpikcu severity...

CVE-2023-29489

CVE-2023-29489 该安全漏洞记录在通用漏洞披露（CVE）系统中。具体而言，此漏洞与 cPanel（一种流行的托管管理软件）有关。该缺陷允许通过特制请求实施跨站脚本（XSS）攻击。 关于 CVE-2023-29489 的详细信息 此漏洞允许攻击者通过向 cPanel 界面发送特制请求，在用户浏览器中执行恶意 JavaScript 代码 💻。这可能导致敏感信息 🔒（例如会话 Cookie）被盗，或代表用户执行未授权操作 🚫。 严重性 ⚠️ 根据通用漏洞评分系统（CVSS）的评级，此漏洞被评为中等严重程度（大约 5.4/10，具体取决于实现）。 受影响版本 🗓️ 已修补版本之前的...

CVE-2022-22947-POC

Spring-Cloud-Gateway-CVE-2022-22947 Spring Cloud Gateway远程代码执行漏洞的安全公告。该漏洞为当Spring Cloud Gateway启用和暴露 Gateway Actuator 端点时，使用 Spring Cloud Gateway 的应用程序可受到代码注入攻击。攻击者可以发送特制的恶意请求，从而远程执行任意代码。 【受影响版本】 Spring Cloud Gateway = 3.1.1 Spring Cloud Gateway = 3.0.7 Spring Cloud Gateway 是基于 Spring Framework 和...

stack-overflow-poc

CVE-2018-12086 PoC https://nvd.nist.gov/vuln/detail/CVE-2018-12086 https://opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2018-12086.pdf TL;DR: 某些 OPC UA 堆栈在解码特制请求时容易受到堆栈溢出攻击。 构建 mvn clean package 运行 java -jar target/stack-overflow-poc.jar...

CVE-2024-36401_Geoserver_RCE_POC

⚠️ 免责声明： 此工具仅供安全研究与合法授权测试使用，请勿用于非法用途。使用者需自行承担法律责任。 README Version: English | 中文 漏洞描述 本脚本是针对 GeoServer 的远程代码执行漏洞（CVE-2024-36401）开发的 PoC（Proof of Concept）探测工具。该漏洞允许攻击者通过构造特定请求，在目标服务器上执行任意命令。 环境依赖 请确保你的运行环境已安装以下依赖项： Python 3.x 第三方库： requests lxml 可通过以下命令安装所需依赖： root@kitploit: pip install requests lxm...

RLSA-2026:67308 Moderate: nginx:1.24 security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 For more details about the security issues, including the impac...

Linux Distros Unpatched Vulnerability : CVE-2026-38998

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free in the SocketDescriptor::tcpReadHandler1 function liveMedia/RTPInterface.cpp of LIVE555 Streaming Media version 2026.02.26 allows attackers to...

CVE-2025-55182

CVE-2025-55182 漏洞检测利用工具 项目介绍 本工具是一个基于 Java Swing 开发的 GUI 工具，用于检测和利用 CVE-2025-55182 漏洞。该漏洞是 Next.js 框架中的一个安全漏洞，允许攻击者通过特定的请求构造执行任意命令。 功能特性 1. 漏洞检测 支持批量 URL 扫描 多线程并发扫描，提高检测速度 实时显示扫描进度和计数（如：1/1000 0%） 只显示存在漏洞的目标，过滤无关信息 支持导入文件批量检测 提供停止扫描功能 2. 命令执行 支持执行 Linux/Windows 命令 自动或手动选择目标操作系统 实时显示命令执行结果 3...

FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests

A flaw was found in FreeRDP. When smartcard emulation is enabled, a remote attacker can send specially crafted smartcard cache requests to a FreeRDP client. This can lead to a null pointer dereference, causing the client process to terminate and disrupting active remote desktop sessions...

FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests

A flaw was found in FreeRDP. When smartcard emulation is enabled, a remote attacker can send specially crafted smartcard cache requests to a FreeRDP client. This can lead to a null pointer dereference, causing the client process to terminate and disrupting active remote desktop sessions...

CVE-2026-19203

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of...

UBUNTU-CVE-2026-19203

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of...

EUVD-2026-72586

@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data...

GHSA-RVF3-5QRX-MRJ3 vulnerabilities

Vulnerabilities for packages: freeipa...

FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests

A flaw was found in FreeRDP. When smartcard emulation is enabled, a remote attacker can send specially crafted smartcard cache requests to a FreeRDP client. This can lead to a null pointer dereference, causing the client process to terminate and disrupting active remote desktop sessions...

Next.js Unauthenticated RCE on Windows Servers

This module exploits a Remote Code Execution RCE vulnerability in Next.js applications hosted on Windows servers. Specifically crafted requests can execute arbitrary code on the target server. The affected versions include releases from 13.4.0 up to 15.5.24, and 16.0.0 up to 16.3.3, utilizing bot...

Astra Linux – Vulnerability in json-smart

A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4, which causes a denial of service DOS through a crafted web request...

Astra Linux – Vulnerability in dcmtk

DCMTK through version 3.6.6 does not handle memory deallocation properly. The malloc function allocates heap memory for data parsing, but does not deallocate that memory when there are errors in parsing. Sending specific requests to the dcmqrdb program leads to memory leaks. An attacker can use...

Astra Linux – Vulnerability in Zabbix

The Zabbix server is vulnerable to a Denial-of-Service DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, causing the server to allocate an excessive amount of memory and perform CPU-intensive decompression operations. This...