55229 matches found
CVE-2024-43363
CVE-2024-43363 CVE-2024-43363 Exploit Script This Python script is designed to test if a Cacti instance is vulnerable to CVE-2024-43363, a Remote Code Execution RCE vulnerability caused by log poisoning. How the Vulnerability Works: root@kitploit: Log Poisoning: An attacker injects PHP code into...
ripple20
"Ripple20" Treck IOT/ICS 设备发现与漏洞利用检测 v0.2 Summary: 一个用于被动检测 Treck 设备、发现/扫描尝试以及针对 Treck TCP/IP 协议栈中 "Ripple20" 系列漏洞的利用行为的 Zeek 包。 References: https://corelight.blog/2020/06/30/ripple20-zeek-package-open-sourced/ https://www.jsof-tech.com/ripple20/ 由 JSOF 提供的 python/scapy 扫描包。...
Mobile-Drop-Device-SOC-Detection
🛡️ 幻影项目：移动"投递设备"SOC检测模拟 该项目展示了一个端到端的SOC实验室工作坊，模拟一台未经授权的、无root权限的安卓设备（Casper Via S）作为内部网络中的"投递设备"，在发动关键第7层攻击（Web扫描、远程代码执行）时如何通过Wazuh SIEM被检测到。 该仓库展示了移动渗透测试（红队）、SIEM日志集成（蓝队）以及自定义规则创建（检测工程）的融合，以缓解"影子设备"威胁。 🎯 项目目标（执行摘要） 1. 攻击向量： 将一台标准的、无root权限的移动设备转换为功能性渗透测试工作站（投递设备），通过PRoot Debian实现，无需硬件修改（root）。 2...
CVE-2025-6019_Exploit
CVE-2025-6019Exploit 第一步 在linux设备上运行1.sh,构建xfs.image 第二步 将xfs.image传入受害设备执行2.sh 如下即为成功 root@kitploit: neko@aosc-neko205 tmp $ bash 2.sh 当前用户: neko uid=1000neko gid=1001neko 组=1001neko,11audio,12video,15cdrom,974ollama,997wheel,999plugdev,1002gamemode 'yes', Mapped file /home/neko/xfs.image as...
gardyn
Resumen En febrero de 2025 realicé una investigación de seguridad en un dispositivo Gardyn Home 4.0. Durante mi investigación, descubrí múltiples vulnerabilidades y malas prácticas de seguridad. Al aprovechar estas vulnerabilidades, un atacante podría obtener acceso a nivel de sistema a un...
DEBIAN-CVE-2026-84270
A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested,...
CVE-2026-84270
A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested,...
CVE-2026-51767
Incorrect access control in the recvClearPairCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reset pairing state and reboot the device via sending a crafted MQTT message to the csbroker component...
CVE-2019-13361
CVE-2019-13361 如何 数据包1：攻击者更新Wi-Fi设置 数据包2：设备回复其ID及成功/错误代码 数据包3：攻击者利用该ID解除设备布防...
cs4239-cve-2020-15873
CVE-2020-15873 CVE-2020-15873 的概念验证 - LibreNMS librenms librenms 开发 调试 LibreNMS Docker 实例 1. 获取容器的 shell： $ sudo docker exec -it librenmsvuln /bin/bash 2. 读取 LibreNMS 生成的日志： $ tail -f /opt/librenms/logs/librenms.log 调试 MariaDB Docker 实例 1. 获取容器的 shell： $ sudo docker exec -it librenmsdbvuln...
CVE-2026-84270 Gvfs: mtp: out-of-bounds read in do_read()
A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested,...
CVE-2026-84270 Gvfs: mtp: out-of-bounds read in do_read()
A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested,...
CVE-2026-84270 Gvfs: mtp: out-of-bounds read in do_read()
A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested,...
CVE-2026-84270
The affected software is gvfs (GNOME Virtual Filesystem), specifically its MTP backend . The flaw resides in do_read() within gvfsbackendmtp.c , which trusts the data length returned by a connected MTP device without capping it to the size originally requested by the client. When a malicious devi...
EUVD-2026-69298
A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested,...
CVE-2026-84270
A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested,...
CVE-2026-78012
An issue in the NetStaX EtherNet/IP Stack prior to v5.6.1 could allow a large Class 3 explicit-message request to exceed the application-side receive buffer without generating an error or warning. The result could be memory corruption, a device crash, or a potential remote attack vector without t...
CVE-2026-51751
Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove a specified slave device from local mesh management data and reboot the system via sending a crafted MQTT message to the csbroker component...
fire-hd-ownership
fire-hd-ownership 真正拥有我早已买下的平板。 2022 年 11 月，我在 eBay 上以 114.26 美元买了一台 Fire HD 10（第 11 代，2021 款），打算用作 Home Assistant 信息亭。它平稳运行了几年，然后开始自动关机。日志说明了原因：是亚马逊自家的软件发出了关机指令，而肇事的软件包受到保护，设备所有者无法触碰。唯一的永久修复是获取 root 权限——而此前从未有人在这款硬件上成功过。 五个月后，经过四款 AI 模型的接力协作，以及 266.15 美元的 API 账单和订阅费用，这台平板终于归我所有：root shell、SELinu...