CVE-2022-42889

🚀 CVE-2022-42889 Text4Shell エクスプロイト CVE-2022-42889 Text4Shell の Python エクスプロイトです。Apache Commons Text のバージョン 1.10.0 未満における重大なリモートコード実行脆弱性です。 📋 目次 説明 脆弱性の詳細 影響を受けるバージョン エクスプロイトの機能 必要条件 使用方法 使用例 動作の仕組み 検出方法 緩和策 参考文献 免責事項 📝 説明 このエクスプロイトは、CVE-2022-42889 Text4Shell を標的としています。これは Apache Commons Text...

w1f1t3kAl1

Wifite This repo is a complete re-write of wifite, a Python script for auditing wireless networks. Wifite runs existing wireless-auditing tools for you. Stop memorizing command arguments & switches! Wifite is designed to use all known methods for retrieving the password of a wireless access point...

Claude-Code-MCP-Injection-PoC

Claude Code: MCPツール確認プロンプトの誤表示 AnthropicのClaude Codeにおける重大なUI/UXの欠陥を示すプロフェッショナルなProof-of-Concept（PoC）です。この脆弱性により、悪意のあるMCPサーバーが確認プロンプトでツールパラメータを誤って表示することで、ユーザーを騙して任意のコマンド実行を承認させることが可能になります。 🛡️ 技術概要 Claude...

cosmicsting-validator

A Cosmicsting POC で、全ホストサイトのパッチ適用を確認するためのbashスクリプトが付属しています。 このリポジトリは、ストアの所有者やホストがストアにパッチが適用されていることを確認できるように提供されています。check.bash 内の SITES リストにドメインを追加してください。 https://www.sdj.pw/posts/magento2-cosmic-sting-check/ オンラインバリデータ https://cosmicsting.samdjames.uk/ Setup root@kitploit: Create a python virtua...

IPAnalyzer

IPAnalyzer IPAnalyzer is an OSINT ethical hacking tool built for Linux distributions, designed to gather detailed information about IP addresses. This tool provides geolocation, timezone, country code, ASN, and other valuable data related to any given IP address. It also integrates with the Tor...

Security Bulletin: The Hub App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Hub App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-42033 DESCRIPTION: Axios is a promise based HT...

CVE-2015-5287

CVE-2015-5287 RHEL 7.0/7.1 - 'abrt/sosreport' Escalada de Privilegios Local Donar Ayuda a mantener este proyecto Si encuentras útil este proyecto, considera apoyar su mantenimiento continuo a través de PayPal o ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️...

CVE-2026-88018

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...

DEBIAN-CVE-2026-88018

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...

IPGhost

IPGhost IPGhost is a strong tool for ethical hackers. It helps you stay private and anonymous online by using the Tor network. This tool automatically changes your IP address, making it hard for anyone to track your online activities. Features Automatic installation of required dependencies Tor,...

CVE-2026-88018

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...

EUVD-2026-75585

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...

CVE-2026-88018

rclone (a command-line tool for syncing files to cloud storage) contains a SigV4 signature bypass in its serve s3 mode. When configured with --auth-proxy but without --auth-key, the authPairMiddleware registers any client-chosen accessKeyID with an empty secret. The embedded gofakes3 component th...

CVE-2026-88018 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...

CVE-2026-88018

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...

CVE-2026-88018 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...

CVE-2026-88018 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...

google-osconfig-privesc

Resumen El proceso googleosconfigagent es un componente de la herramienta GoogleCloudPlatform https://github.com/GoogleCloudPlatform/osconfig que se ejecuta en cada VM por defecto. El agente se ejecuta como root y es responsable de algunos servicios controlables por el usuario, incluyendo OS conf...

edu-recon

edu-recon 面向教育行业红蓝对抗演练 的授权侦察与分诊编排器。 放入目标，它就会运行扫描器、过滤噪声，并在 Web UI 中交给你一个按优先级排序的 待审队列。专为部署在你的 Linux 机器（Kali / 基础设施）上、通过浏览器驱动而构建。 ⚠️ 仅限授权使用。 只可指向你已获授权测试的系统。 范围锁定默认关闭 ——授权由操作者负责。对于真实 交战，你可以在 config.yaml 中通过 scopeenforce: true 重新启用锁定的范围允许列表（此后每个阶段在执行前都会重新检查范围）。 快速开始 · 复制粘贴即可 Kali / Debian / Ubuntu ——...

nagiosxi-root-rce-exploit

nagiosxi-root-exploit Overview A vulnerability exists in Nagios XI = 5.6.5 allowing an attacker to leverage an RCE to escalate privileges to root. The exploit requires access to the server as the 'nagios' user, or CCM access via the web interface with perissions to manage plugins. Details The...