Dragnmove

Dragnmove Dragnmove 是一款后渗透工具，它会感染用户之间共享的文件，以便从一个系统移动到另一个系统。Dragnmove 可以检测诸如将文件拖放到浏览器窗口或向电子邮件客户端附加文件等操作。在 Dragnmove 检测到该操作后，它会挂钩 CreateFile API 调用来修改句柄。 用法 正在进行中！！！ 根据你的环境更改 TARGETWINDOW 和 PAYLOADFILE 使用 VS2019-VS2022 编译 Dragnmove。 将 Dragnmove DLL 注入目标进程。 待办事项 让工具在不同应用程序中保持稳定 创建 BOF 版本 实现自动感染机制...

Arbitrary File Upload

Overview ci4-cms-erp/ci4ms is a composer create-project ci4-cms-erp/ci4ms Affected versions of this package are vulnerable to Arbitrary File Upload via the createFile and save endpoints. An attacker can execute arbitrary code on the server by creating a file with a dangerous extension and injecti...

A deep dive into MUTZ

AtDEF CON 33, we shared our research into MapUrlToZone, a critical Windows security component that determines whether a given path is local, on the intranet, or on the broader Internet. This classification drives several security decisions across Windows, for example, preventing a CreateFile call...

EUVD-2007-3386

Malware in sbrugna...

EUVD-2019-0744

Malware in sbrugna...

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php

...

CVE-2024-42481

CVE-2024-42481 affects the Skyport Daemon (skyportd) used with Skyport Panel. The root cause is lack of rate limiting on createFolder and createFile, enabling exploitation by creating thousands of folders/files which can drive 100% CPU usage and cause an Out-of-Memory condition, potentially crash...

The vulnerability of the CreateFile method in the SolarWinds Access Rights Manager software allows a perpetrator to execute arbitrary code.

The vulnerability of the CreateFile method in the SolarWinds Access Rights Manager ARM access control software lies in improper restrictions on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

SolarWinds Access Rights Manager CreateFile Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Access Rights Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CreateFile method. The issue results from the lack of proper...

PT-2024-4872 · Solarwinds · Solarwinds Access Rights Manager

Name of the Vulnerable Software and Affected Versions: SolarWinds Access Rights Manager affected versions not specified Description: The issue is related to the CreateFile method in SolarWinds Access Rights Manager, which is susceptible to a directory traversal vulnerability. This vulnerability c...

CVE-2020-15779: Improper Limitation of a Pathname to a Restricted Directory

A Path Traversal issue was discovered in the socket.io-file package through 2.0.31 for Node.js. The socket.io-file::createFile message uses path.join with ../ in the name option, and the uploadDir and rename options determine the path...

GHSA-9H4G-27M8-QJRG Path Traversal in socket.io-file

All versions of socket.io-file are vulnerable to Path Traversal. The package fails to sanitize user input and uses it to generate the file upload paths. The socket.io-file::createFile message contains a name option that is passed directly to path.join. It is possible to upload files to arbitrary...

GHSA-CJ8P-53V9-2C26 Cross-site Scripting in Bolt

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php...

Cross-site Scripting in Bolt

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php...

CVE-2019-15485

CVE-2019-15485: Bolt before 3.6.10 is vulnerable to cross-site scripting via createFolder or createFile in Controller/Async/FilesystemManager.php. The issue affects Bolt CMS versions prior to 3.6.10 and is exploitable through crafted input in file/folder creation paths, as documented in multiple ...

CVE-2019-15485: Improper Neutralization of Input During Web Page Generation

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php...

Microsoft Windows 10 - DSSVC DSOpenSharedFile Arbitrary File Open Privilege Escalation

Windows: DSSVC DSOpenSharedFile Arbitrary File Open EoP Platform: Windows 10 1803 and 1809. Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: User boundary NOTE: This is one of multiple issues I’m reporting in the same service. While I’ve tried to ensure all t...

Microsoft Windows - DSSVC CheckFilePermission Arbitrary File Deletion Exploit

Exploit for windows platform in category local exploits Windows: DSSVC CheckFilePermission Arbitrary File Delete EoP Platform: Windows 10 1803 and 1809. Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: User boundary NOTE: This is one of multiple issues I’m...

Microsoft Windows - DSSVC CheckFilePermission Arbitrary File Deletion

Windows: DSSVC CheckFilePermission Arbitrary File Delete EoP Platform: Windows 10 1803 and 1809. Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: User boundary NOTE: This is one of multiple issues I’m reporting in the same service. While I’ve tried to ensure...

Microsoft Windows - DSSVC CheckFilePermission Arbitrary File Deletion

Microsoft Windows - DSSVC CheckFilePermission Arbitrary File Deletion Windows: DSSVC CheckFilePermission Arbitrary File Delete EoP Platform: Windows 10 1803 and 1809. Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: User boundary NOTE: This is one of multiple...