CVE-2020-15778-SCP-Command-Injection-Check

CVE-2020-15778 – OpenSSH SCP 命令注入漏洞（检测脚本） 关于 CVE-2020-15778 是 OpenSSH（版本 ≤ 8.3p1）提供的 scp 工具中发现的一个命令注入漏洞。该问题允许攻击者在客户端系统上执行任意命令，前提是向 scp 传递了包含反引号的构造目标参数。 此仓库包含一个用 Bash 编写的安全检测与模拟脚本 。该脚本可帮助用户和系统管理员： 识别其系统的 scp 版本是否存在漏洞 了解漏洞的工作原理 测试并检测危险的命令输入（例如包含反引号的参数） 学习如何缓解和避免该漏洞 什么是 CVE-2020-15778？ 在 OpenSSH scp...

CVE-2016-4971

CVE-2016-4971 在服务器将HTTP重定向到FTP资源时，wget会信任HTTP服务器，并使用重定向URL中的名称作为目标文件名。 详情请见我在博客上发布的文章。 用法 在你的服务器上， node wget.js 在你的测试电脑上， wget http://url.to.your/server 截图 截图1 截图2...

EUVD-2026-93488

Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes. This...

CVE-2026-105846

The Payload headless content management system is vulnerable to an Open Redirect (CWE-601) in versions 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27 . An attacker can craft a malicious redirect URL parameter that sends a guest user to an untrusted destination immediately followi...

CLEANSTART-2026-KC53993 When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh

CVE-2026-39832 affects multiple packages. When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh. See references for individual vulnerability details...

CVE-2026-102576

A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting XSS. Because the application does not validate the redirect destination before navigating, this flaw allows the execution of arbitrary script in the context of...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: crypto: scomp – fixed the req-dst buffer overflow issue. The size of the req-dst buffer should be checked before copying data from scompscratch-dst to avoid the req-dst buffer overflow problem...

Astra Linux – Vulnerability in edk2

EDK2’s Network Package is vulnerable to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of availability...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfreject: Do not leak the destination refcount for loopback packets. Recent patches that added a warning when replacing the skb dst entry fixed an old bug. WARNING: include/linux/skbuff.h:1165 – skbdstcheckunset...

CVE-2024-36971

CVE-2024-36971 — 概念验证（仅限研究与分析） ⚠️ 免责声明 — 使用本仓库前请阅读 本仓库仅 用于防御性研究、分析和负责任的报告 。 它包含一个不可利用的概念验证文件，名为 CVE-2024-36971，以及一个公开可用的 Android 内核头文件片段（sock.h），用于说明受影响的区域。 不提供任何漏洞利用代码、复现命令或逐步操作说明。 请不要 在正式设备、第三方系统或非您控制的网络上运行本仓库中的任何文件。作者对误用不承担任何责任。 目录 1. 概述 2. 仓库内容 3. 高级技术摘要 4. 关于包含的 sock.h 片段 5. 研究环境（高级，不可操作） 6...

CVE-2020-15778

CVE-2020-15778 简介 本仓库复现了 CVE-2020-15778。 步骤 1. 构建 scp 服务器和客户端的 Docker 镜像 cd client docker build -t client-cve . cd server docker build -t server-cve . 2. 在容器中启动 scp 服务器。 docker run -d -P --name scp-server server-cve 通过以下命令获取 scp 服务器的内部 IP 地址： docker inspect --format='range...

cve-2026-16219-croogo-lab

CVE-2026-16219：Croogo FileManager 防御性实验室 本仓库记录并安全地演示了 Croogo CMS 中编号为 CVE-2026-16219 的路径授权缺陷。它面向防御者、维护者、学生以及对自己拥有或获明确授权评估的系统进行测试的研究人员。 安全边界： 附带的 HTTP 概念验证仅接受字面回环地址 127.0.0.1，仅在固定的非 Web 目标目录 /tmp/croogo-cve-2026-16219/ 中写入一个生成的 .txt 标记文件，不跟随重定向，并且在没有明确实验室确认的情况下拒绝运行。它不包含可执行载荷，也没有远程目标模式。 状态快照...

CVE-2026-49097

camel-irc irc.sendTo 头部注入复现工具 CVE-2026-49097 该项目演示了 Apache Camel 的 camel-irc 组件中的一个消息头注入 漏洞，追踪编号为 CVE-2026-49097 。IrcProducer 读取 irc.sendTo 头部以选择出站 IRC 消息的目标；当该头部存在时，会覆盖端点配置的频道列表 ： // IrcProducer.process 受影响版本 4.18.2 final String sendTo = exchange.getIn.getHeaderIrcConstants.IRCSENDTO,...

CVE-2024-38063

CVE-2024-38063 PoC | DKob & N3TCR4SH 概述 此脚本是针对CVE-2024-38063的概念验证（PoC）。它生成并发送带有特定目标选项的恶意分片IPv6数据包，以攻击内核，可能导致拒绝服务或不稳定。 文章链接：这里 视频链接：这里 PoC代码：这里 代码文档：这里...

arpy

Arpy Arpy is an easy-to-use ARP spoofing MiTM tool for Mac. It provides 3 targeted functions: Packet Sniffing Visited Domains Visited Domains with Gource Each function will be explained below. Tested OS to date Darwin 14.3.0 Darwin Kernel Version 14.3.0 Mac OS X Requirements Python 2.7 Gource Sca...

PT-2026-104392

Name of the Vulnerable Software and Affected Versions image-downloader version 4.3.0 Description A path traversal issue exists where an attacker who can control the download URL can cause the downloaded response data to be written outside the configured destination directory. Path traversal is a...

EUVD-2026-90589

A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter rd during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an...

Rocky Linux 9 [CIQ] Security Update: python-unversioned-command / python3 / python3-debug / etc (crlsa-2026_54268)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202654268 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding description...

Rocky Linux 8 [CIQ] Security Update: python3.12 / python3.12-debug / python3.12-debuginfo / etc (crlsa-2026_58971)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202658971 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding description...

CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1787291758)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1787291758 advisory. - The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known ...