9015 matches found
CVE-2021-28663
CVE-2021-28663 针对 CVE-2021-28663 的基础信息泄露 PoC（Android 内核后门漏洞内幕） 这是针对 CVE-2021-28663 的基础 PoC。Mali GPU Android 内核驱动中存在一个设计缺陷。 1. 创建一个 GPUVA，并对其执行 mmap，这样我们就能获得物理页对应的虚拟地址。 2. 为物理页创建一个别名，但不要执行 mmap，这样 gpumapping 保持为 1。 3. 将 GPUVA 的标志修改为 BASEMEMDONTNEED。Mali 会将这些页置为可驱逐状态。 4. 由于我们已经持有别名页的 reg，现在可以对其执行...
cve-2025-29927
CVE-2025-29927 CVE-2025-29927 漏洞 从 11.1.4 到 13.5.6 的所有 Next.js 版本，以及 14.x 中 14.2.25 之前的版本、15.x 中 15.2.3 之前的版本均受此漏洞影响。对于依赖中间件实现访问控制的应用程序来说，影响尤为严重，攻击者可以在无需认证的情况下获取对受保护资源的未授权访问。 漏洞机制 CVE-2025-29927 漏洞源于 Next.js 处理 x-middleware-subrequest 头部的设计缺陷。该头部最初是 Next.js 框架内部使用的，用于防止中间件无限执行循环。 当 Next.js...
ets5-password-recovery
ETS5 Password Recovery Tool Table of Contents Introduction Installation Requirements How does the password recovery work? How was the design flaw discovered? How can the risk be mitigated? Coordinated Vulnerability Disclosure License Change log Introduction Have you forgotten the password to one ...
tech-seminar-React2Shell
React2Shell CVE-2025-55182 Woori FISA Technical Seminar 6th - Team 3: Analysis and research on React2Shell, a remote code execution RCE vulnerability exploiting design flaws in React Server Component RSC Team...
CVE-2025-49844_POC
CVE-2025-49844POC CVE-2025-49844 POC -h 查看帮助信息 ··· Redis 存在Redis Lua脚本远程代码执行漏洞CVE-2025-49844。该漏洞的成因核心是 Redis 中 Lua 脚本引擎与内存管理逻辑的交互存在设计缺陷。 ··· ··· 相关URL：https://nvd.nist.gov/vuln/detail/CVE-2025-49844 ··· 免责声明：请确保在有授权的情况下使用此脚本，禁止用于未授权的网络攻击。...
CVE-2020-0096-StrandHogg2
此设计缺陷使攻击者可以在另一个应用程序的顶部显示其自己的活动（页面），从而可能使用户迷失自己的私人数据。该漏洞被称为StrandHogg 2.0，最近由挪威安全公司Promon披露。 范围：理论上是全版本 android10测试失败了，测试8.0.1测试成功 验证步骤： 修改代码为目标app的包名和导出的activity 启动目标app的目标activity 启动测试app 在启动目标app发现劫持成功 LINKS https://source.android.com/security/bulletin/2020-05-01...
POC-2020-8558
概述 CVE-2020-8558 是一个 Kubernetes 漏洞，它之所以被公布，是因为 kube-proxy 意外地 让绑定到 localhost 的主机服务对网络上的其他节点可用。我特意强调"意外地"，是因为这个漏洞源于设计缺陷（疏忽），而非实现缺陷（bug）。代码确实做了它声称要做的事，但我们所有人都未能认识到这一决定的安全影响。 为了让主机进程能够通过 127.0.0.1（localhost）地址访问 NodePort 服务，kube-proxy 会设置 net.ipv4.conf.all.routelocalnet=1 这个 sysctl...
CVE-2026-42085
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, OpenC3 COSMOS contains a design flaw in the savetoolconfig function that allows saving tool configuration files at arbitrary locations...
CVE-2026-42085
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, OpenC3 COSMOS contains a design flaw in the savetoolconfig function that allows saving tool configuration files at arbitrary locations...
CVE-2025-66286
An API design flaw in WebKitGTK and WPE WebKit allows untrusted web content to unexpectedly perform IP connections, DNS lookups, and HTTP requests. Applications expect to use the WebPage::send-request signal handler to approve or reject all network requests. However, certain types of HTTP request...
CVE-2025-66286
An API design flaw in WebKitGTK and WPE WebKit allows untrusted web content to unexpectedly perform IP connections, DNS lookups, and HTTP requests. Applications expect to use the WebPage::send-request signal handler to approve or reject all network requests. However, certain types of HTTP request...
EUVD-2026-17585
The MS27102A Remote Spectrum Monitor is vulnerable to an authentication bypass that allows unauthorized users to access and manipulate its management interface. Because the device provides no mechanism to enable or configure authentication, the issue is inherent to its design rather than a...
CVE-2026-3356
The CVE-2026-3356 entry concerns the MS27102A Remote Spectrum Monitor, a device that exposes an authentication bypass vulnerability. The providedConnected documents (Red Hat, ENISA EUVD, NVD/NVD-related, CISA ICS advisory, AttackersKB, CVE listing, and PT-Security) consistently describe a flaw in...
CVE-2026-3356 Missing Authentication for Critical Function vulnerability in Anritsu Remote Spectrum Monitor
The MS27102A Remote Spectrum Monitor is vulnerable to an authentication bypass that allows unauthorized users to access and manipulate its management interface. Because the device provides no mechanism to enable or configure authentication, the issue is inherent to its design rather than a...
CVE-2026-30310
In its design for automatic terminal command execution, Sixth offers two options: Execute safe commands and Execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a command to be...
Sixth 安全漏洞
Sixth is an artificial intelligence code assistant developed by the Nigerian company Sixth. There is a security vulnerability in Sixth, which stems from its design, making it susceptible to prompt injection attacks, potentially leading to arbitrary command execution...
NVIDIA Isaac Launchable Arbitrary Code Execution Vulnerability
NVIDIA Isaac Launchable is a one-click deployment GPU development environment designed to simplify the AI development process and accelerate experimentation and deployment. NVIDIA Isaac Launchable suffers from a security vulnerability that stems from improper design and can be exploited by remote...
EUVD-2011-2100
Malware in sbrugna...