GDRVLoader

GDRVLoader - Load Unsigned Drivers Windows 10-11 Originally based from https://github.com/fengjixuchui/gdrv-loader but with improvements and support for latest windows versions. Added Features Load unsigned drivers on Windows 10-11 without getting caught by PatchGuard. Improved portability throug...

CVE-2024-7479_CVE-2024-7481

CVE-2024-7479 & CVE-2024-7481 TeamViewer User to Kernel Elevation of Privilege This repository contains the exploit proof of concept of a vulnerability in TeamViewer that enables an unprivileged user to load an arbitrary Kernel Driver into the system. I would like to thank Zero Day Initiative for...

HotLoad-Driver

Hot Load Your Driver Using C++ this project was Bsides Augusta for the RAT talk. Slides can be seen bellow and are extremely helpful for understanding the execution flow. These two methods have separate projects. Demo / Slides:...

DriverJack

DriverJack Introduction DriverJack is a tool designed to load a vulnerable driver by abusing lesser-known NTFS techniques. These method bypass the registration of a Driver Service on the system by hijacking an existing service, and also spoof the image path presented in the Driver Load event. To...

breakcyserver

breakcyserver Full post in: https://waawaa.github.io/ 1. Kill EDR services by killing all the opened handles of the EDR process. 2. Bypass PPL by abussing some Process Explorer drivers functionalities. 3. Bypass ObRegisterCallbacks implementation by abussing Process Explorer driver...

CallMeWin32kDriver

CallMeWin32kDriver Load your driver like win32k.sys Motivation This feature was analyzed from a certain PUBG cheat driver. What it can do? Protection against direct dump by Anti-Rootkit tools Bypass MmCopyMemory Hide world does not trigger PG How to detect? Attach a GUI process before using...

masm32-kernel-programming

masm32-kernel-programming Dreg's repo for his own needs masm32 kernel programming, drivers, tutorials, examples, and tools credits Four-F Instructions download/clone this repo run masm32v11rinstall.exe click on install image earth install masm32 in C:\ I recommend add to PATH environment variable...

...[ More ]

Apache Impala versions 2.7.0 through 4.5.1 suffer from an insufficient authorization vulnerability that leads to remote code execution. A table created with STORED BY JDBC takes a driver.url property that Impala uses to fetch a remote JAR and load the named driver class on first query, and the...

VortexCry-Ransomware-Release

VortexCry-Ransomware VortexCry is an advanced ransomware that utilizes multi-stage process injection such as Process Hollowing and APC Injection and kernel driver loading via the CVE-2019-16098 vulnerability. It is capable of encrypting files, destroying system recovery functionalities, and...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: PCI: Endpoint – Add a missing NULL check for allocworkqueue. allocworkqueue may return NULL in case of memory allocation failure. Without proper error checking, this could lead to dereferencing a NULL pointer when queuework is...

CVE-2025-71313

In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Add missing NULL check for allocworkqueue allocworkqueue can return NULL on memory allocation failure. Without proper error checking, this may lead to a NULL pointer dereference when queuework is later called with...

CVE-2025-11156

CVE-2025-11156 affects the Netskope NS Client on Windows. A local, authenticated user with Administrator privileges can improperly load the NS Client driver as a generic kernel service, triggering a system crash (Blue Screen of Death) and a Denial of Service on the affected machine. The descripti...

CVE-2023-53563

In the Linux kernel, the following vulnerability has been resolved: cpufreq: amd-pstate-ut: Fix kernel panic when loading the driver After loading the amd-pstate-ut driver, amdpstateutcheckperf and amdpstateutcheckfreq use cpufreqcpuget to get the policy of the CPU and mark it as busy. In these...

CVE-2023-53563

CVE-2023-53563 relates to the Linux kernel amd-pstate-ut driver. The root cause is that after calling amd_pstate_ut_check_perf() and amd_pstate_ut_check_freq(), the code uses cpufreq_cpu_get() to obtain the CPU policy but fails to release it with cpufreq_policy_put, causing the policy to remain b...

The vulnerability of the smp_processor_id() function in the drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c kernel of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the smpprocessorid function in the drivers/vfio/pci/hisilicon/hisiaccvfiopci.c module of the Linux operating system is related to the assignment of the NUL address value due to incorrect loading of drivers in the guest operating system. Exploiting this vulnerability can allow...

CLSA-2025-1744782967 ghostscript: Fix of 3 CVEs

CVE-2024-33871: fix arbitrary code execution by restricting Driver parameter to load only known dynamic libraries in gdevopvp.c - CVE-2023-38559: fix buffer overflow flaw in devnpcxwriterle function by adding input validation checks - CVE-2024-29510: fix memory corruption and SAFER sandbox bypass...

Linux Distros Unpatched Vulnerability : CVE-2022-48868

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Let probe fail when workqueue cannot be enabled The workqueue is enabled wh...

Siemens SIMATIC IPC DiagBase 安全漏洞

Siemens SIMATIC IPC DiagBase is a diagnostic software from Siemens, Germany, used to monitor and diagnose the hardware and system status of SIMATIC IPCs industrial computers. A security vulnerability exists in Siemens SIMATIC IPC DiagBase that stems from affected devices not properly restricting...

PT-2025-6202 · Siemens · Simatic Ipc Diagmonitor +1

Name of the Vulnerable Software and Affected Versions: SIMATIC IPC DiagBase All versions SIMATIC IPC DiagMonitor All versions Description: A vulnerability has been identified where the affected devices do not properly restrict user permissions for the registry key. This could allow an authenticat...

OESA-2024-2454 ghostscript security update

Ghostscript is an interpreter for PostScript™ and Portable Document Format PDF files. Ghostscript consists of a PostScript interpreter layer, and a graphics library. Security Fixes: Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and...