9791 matches found
the-backdoor-factory
The new version of BACKDOOR FACTORY is available! Get access here: https://github.com/sponsors/secretsquirrel WARNING: Pull Requests WILL BE IGNORED AND CLOSED. The Backdoor Factory BDF For security professionals and researchers only. The goal of BDF is to patch executable binaries with user...
WindowsPatchDetector
Experimental Windows .text section Patch Detector ====================== Experimental: Windows .text section compare - disk versus memory Original Idea After reading about the Skeleton Key malware http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis/ develop ...
citrix-2025
Detection Script for Citrix NetScaler appliances Author: NCSC-NL !WARNING Some of these checks are meant to hunt for compromises, while other checks verify if you are compromised. Disclaimer These scripts are provided without any guarantees regarding its effectiveness. The detection capabilities ...
CVE-2026-111254
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.10.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2026-32606-POC
Proof-of-Concept for CVE-2026-32606 This repo has simple proof-of-concept code exploiting a common weakness initially described over a year ago at https://oddlama.org/blog/bypassing-disk-encryption-with-tpm2-unlock/. While it specifically targets IncusOS, the attack is pretty generic against most...
EUVD-2026-114591
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.10.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2026-111254 W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.10.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2026-111254 W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.10.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2026-111254
The W3 Total Cache plugin for WordPress (versions up to and including 2.10.7 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'comment' parameter. The root cause is insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that exe...
CVE-2015-1769
CVE-2015-1769 PoC for CVE-2015-1769 VHD file to reproduce CVE-2015-1769. VHD doesn't contain actual payload only notepad.exe. Upon mounting inspect system log for reported blocked error if latest patch is installed. Batch script shows how symbolic link was created that triggers the vulnerability...
CVE-2026-111254: boldgrid W3 Total Cache: The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all…
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.10.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
bitlocker-bypass-research
BitLocker Bypass Research Personal security research project — bypassing BitLocker full disk encryption using CVE-2023-21563 BitPixie. What This Is In October 2025, I did a physical laptop recovery assessment on a corporate laptop with BitLocker enabled. The employee forgot their password and the...
platform_external_gptfdisk_AOSP10_r33_CVE-2021-0308
GPT fdisk aka gdisk, cgdisk, and sgdisk and FixParts by Roderick W. Smith, [email protected] Introduction This package includes the source code for four related disk partitioning programs: gdisk -- This program is modeled after Linux fdisk, but it operates on GUID Partition Table GPT disks...
CVE-2026-62300 Filecoin Pin: Unbounded DAG pinning can exhaust filecoin-pin server resources
Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. In daemon deployments up to and including version 1.1.0, POST /pins in src/filecoin-pinning-server.ts checks a caller-supplied CID with CID.parse and passes it to pinStore.pin, but does not enforce...
EUVD-2026-114448
Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. In daemon deployments up to and including version 1.1.0, POST /pins in src/filecoin-pinning-server.ts checks a caller-supplied CID with CID.parse and passes it to pinStore.pin, but does not enforce...
CVE-2026-62300
Filecoin Pin versions up to and including 1.1.0 are vulnerable to uncontrolled resource consumption (CWE-400 ) via unbounded DAG pinning. The POST /pins endpoint in src/filecoin-pinning-server.ts fails to enforce rate limits or per-user quotas, allowing callers to submit large DAGs. The system in...
CVE-2026-61854
VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In reportbuffer.py, maybecleanup uses an unlocked dictionary for once-per-hour cleanup...
EUVD-2026-114280
VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In reportbuffer.py, maybecleanup uses an unlocked dictionary for once-per-hour cleanup...
CVE-2026-61854 VoiceSentinel: Race condition in report buffer cleanup can corrupt transcript data and cause unbounded disk growth
VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In reportbuffer.py, maybecleanup uses an unlocked dictionary for once-per-hour cleanup...
CVE-2026-61854
The VoiceSentinel real-time voice moderation system (versions 2.2.1 to 3.3.1 ) is vulnerable to a race condition in its optional report buffer feature. The root cause is located in report_buffer.py, where _maybe_cleanup() uses an unlocked dictionary for cleanup throttling, allowing simultaneous _...