CVE-2022-37017

CVE-2022-37017 Обход аутентификации для пароля пользовательского интерфейса клиента Symantec Endpoint Protection 14.3.5351 Symantec Endpoint Protection позволяет установить защиту паролем на его интерфейс для предотвращения изменений конфигурации. Эта проверка пароля реализована логикой, которая ...

0xKern3lCrush

0xKern3lCrush Исследование BYOVD в Windows на двух реальных случаях: Safetica ProcessMonitorDriver CVE-2026-0828 и драйвер ThrottleStop, эксплуатировавшийся MedusaLocker CVE-2025-7771. В репозитории описаны открытые интерфейсы, привилегированный результат, к которому приводит каждый из них, и...

CVE-2026-39987

CVE-2026-39987 Эксплойт POC Обзор Этот репозиторий содержит Proof-of-Concept POC скрипт для CVE-2026-39987, уязвимости удалённого выполнения кода RCE до аутентификации в Marimo. Эксплойт использует WebSocket-конечную точку для выполнения произвольных команд на целевой системе. Детали уязвимости C...

cve-2019-12750

Symantec 로컬 권한 상승 - CVE-2019-12750 Kyriakos Economou의 훌륭한 글을 기반으로 합니다: https://labs.nettitude.com/blog/cve-2019-12750-symantec-endpoint-protection-local-privilege-escalation-part-1/ 현재는 x64 및 구형 Windows 버전만 지원됩니다...

Cisco-IOS-XE-CVE-2023-20198

Cisco-IOS-XE-CVE-2023-20198 Эксплойт PoC для CVE-2023-20198 Информация об уязвимости и использование эксплойта предоставлены smokeintheshell см. ссылки Управление конечной точкой, типом содержимого HTTP и заголовками было изменено по сравнению с другими существующими PoC, чтобы работать в...

CVE-2026-105307

A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authzfilter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: usb: kaweth: validate USB endpoints The kaweth driver should validate that the device it is probing has the proper number and types of USB endpoints it expects before binding to it. If a malicious device does not have the sa...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: PCI: Endpoint: pci-epf-test: Add a NULL check for DMA channels before releasing them. The fields dmachantx and dmachanrx of the struct pciepftest can be NULL even after EPF initialization. Therefore, it is prudent to check that...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: usb: xhci: Apply the link chain quirk on NEC isoc endpoints Two distinctly different samples of NEC uPD720200 one with a start/stop bug, one without it were observed to cause IOMMU faults after some “Missed Service Errors”. Th...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: udc: remove warning when queue disabled ep It is possible for the warning message to be triggered during the execution of the mass storage function. WARNING: CPU: 6, PID: 3839 Location: drivers/usb/gadget/udc/core.c:294...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: mptcp: pm: in-kernel: always sets ID as available when rm endp is called. Syzkaller managed to identify a combination of actions that caused this warning to occur: WARNING: net/mptcp/pmkernel.c:1074 at marksubflowendpavailable...

CVE-2026-33017

CVE-2026-33017 - Langflow 인증되지 않은 원격 코드 실행 ⚠️ 면책 조항: 이 저장소는 승인된 보안 테스트 및 교육 목적으로만 제공됩니다. 소유하거나 명시적 테스트 권한이 있는 시스템에서만 사용하십시오. 저자는 이 도구의 오용이나 손해에 대해 책임지지 않습니다. 개요 CVE-2026-33017 은 LangChain 애플리케이션 구축을 위한 시각적 프레임워크인 Langflow의 인증되지 않은 원격 코드 실행 취약점입니다. POST /api/v1/buildpublictmp/flowid/flow 엔드포인트는 인증...

CVE-2026-105290

A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php of the component getCurlData Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is...

CVE-2026-105289

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialcharsdecode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customerformremark resul...

CVE-2026-105291

A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the component Department Search Endpoint. The manipulation of the argument keyword leads to cross...

CVE-2026-105307

A vulnerability exists in Casdoor up to version 3.161.1 involving the API Endpoint component. The issue resides in the ApiFilter function located within the routers/authz_filter.go file, where a manipulation can lead to missing authentication . This flaw allows for remote attacks. While an exploi...

EUVD-2026-92415

A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authzfilter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used...

CVE-2026-105307 Casdoor API Endpoint authz_filter.go ApiFilter missing authentication

A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authzfilter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used...

CVE-2025-57819-FreePBX-RCE2Root

CVE-2025-57819 — FreePBX SQL-инъекция → RCE → Root Полноценный PoC для CVE-2025-57819. Неаутентифицированная ошибка на основе SQL-инъекции в модуле endpoint FreePBX, которая превращается в root shell через внедрение cron-задания и повышение привилегий с помощью incron. Только для авторизованного...

EUVD-2026-92402

A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the component Department Search Endpoint. The manipulation of the argument keyword leads to cross...