clusterfuzz

ClusterFuzz ClusterFuzz is a scalable fuzzing infrastructure that finds security and stability issues in software. Google uses ClusterFuzz to fuzz all Google products and as the fuzzing backend for OSS-Fuzz. ClusterFuzz provides many features which help seamlessly integrate fuzzing into a softwar...

experiments

실험 다양한 실험 / PoC 저장소입니다. debugging-secure-kernel: QEMU KVM 위에서 Windows 10 보안 커널을 gdb로 디버깅하는 PoC dns: DNS / 인증서 투명성 / 호모글리프에 관한 실험 Attack Surface Reduction: Windows Attack Surface Reduction 내부 동작 원리 분석 VDM: Windows Defender의 VDM 형식시그니처 데이터베이스 Primary Group ID: primaryGroupID AD 특성 변경 시 수행되는 보안 검사 분...

cve-2021-44228

cve-2021-44228 이는 안후이 대학 "취약점 분석 실험"3학년 가을-겨울 학기 중간 과제 아카이브입니다. 전체 문서는 https://testgames.me/2024/11/10/cve-2021-44228/ 에 있습니다...

CVE-2017-1000117-sl

CVE-2017-1000117-sl CVE-2017-1000117 실험 사용 방법 root@kitploit: $ git clone --recursive https://github.com/ieee0824/CVE-2017-1000117-sl.git...

CVE-2012-4681-Armoring

CVE-2012-4681-Armoring 개요 CVE-2012-4681에 대한 수동 안티바이러스 회피 강화 실험으로, http://security-obscurity.blogspot.com/2012/11/java-exploit-code-obfuscation-and.html에서 영감을 받았습니다. 기반 익스플로잇: http://pastie.org/4594319 2014년 9월 26일 및 2016년 8월 2일 기준 결과...

CopyFail-Experiment

LLM이 이 취약점을 찾아 작동하는 익스플로잇을 구성할 수 있는지 확인하기 위한 실험입니다. 사용법 root@kitploit: gcc -o poc poc.c ./poc...

os-experiment-4

os-experiment-4 os 실험 4 CVE-2016-5195 ./run.sh...

EUVD-2026-78207

GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experiment endpoints. Attackers with knowledge of a publicly shared report or experiment identifier can read internal data warehouse query text,...

curveball-plus

curveball-plus ECQV 암시적 인증서와 Windows 유사 검증기를 사용한 CurveballCVE-2020-0601 공격 시뮬레이션 실험 이 파일은 지속적으로 업데이트됩니다!...

PT-2026-85556

Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs...

Malicious code in amplitude-experiment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 110901fcd2d59ab6eed44d962da05830610e5c3cb03ca103db5a379e6c6052e4 package.json declares a single dependency whose key equals the package's own name amplitude-experiment and whose source is the bare HTTPS URL...

MAL-2026-15496 Malicious code in amplitude-experiment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 110901fcd2d59ab6eed44d962da05830610e5c3cb03ca103db5a379e6c6052e4 package.json declares a single dependency whose key equals the package's own name amplitude-experiment and whose source is the bare HTTPS URL...

EUVD-2026-62963

In Splunk AI Toolkit versions below 6.0.1, a user who does not hold the "admin" or "power" Splunk roles could delete the experiment history of another user without permission through the Representational State Transfer REST API. The vulnerability is possible because Splunk AI Toolkit deletes...

EUVD-2026-62962

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all relevant data in experiment history, including data associated with other users. The vulnerability is possible because Splunk AI Toolkit does not preserve the trusted experiment scope...

CVE-2026-76398

In Splunk AI Toolkit versions below 6.0.1, a user who does not hold the "admin" or "power" Splunk roles could delete the experiment history of another user without permission through the Representational State Transfer REST API. The vulnerability is possible because Splunk AI Toolkit deletes...

CVE-2026-76397

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all relevant data in experiment history, including data associated with other users. The vulnerability is possible because Splunk AI Toolkit does not preserve the trusted experiment scope...

CVE-2026-76398 Improper Access Control during Experiment History Deletion through the REST API in Splunk AI Toolkit

In Splunk AI Toolkit versions below 6.0.1, a user who does not hold the "admin" or "power" Splunk roles could delete the experiment history of another user without permission through the Representational State Transfer REST API. The vulnerability is possible because Splunk AI Toolkit deletes...

CVE-2026-76397

Splunk AI Toolkit versions below 6.0.0 are affected: a user with the "power" Splunk role can access and delete all experiment history data, including other users' data, because the tool does not preserve the trusted experiment scope when processing caller-controlled query values. CVSS 8.1 (HIGH) ...

CVE-2026-76398

Splunk AI Toolkit versions below 6.0.1 are affected by an improper access control vulnerability in the REST API. A user without the "admin" or "power" Splunk role can delete the experiment history of another user without authorization. The root cause is that the toolkit deletes experiment history...

CVE-2026-76397 Improper Access Control in Experiment History through the REST API in Splunk AI Toolkit

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all relevant data in experiment history, including data associated with other users. The vulnerability is possible because Splunk AI Toolkit does not preserve the trusted experiment scope...