CVE-2024-23897

CVE-2024-23897 CVE-2024-23897 jenkins-cli 우리는 Jenkins 파일 유출 / RCE CVE-2024-23897가 야생에서 악용되는 것을 확인했으며 이를 재현할 수 있었습니다. 만약 Jenkins에서 익명 사용자 또는 사용자 등록을 허용한다면, 즉시 최신 버전으로 업데이트하세요. java -jar jenkins-cli.jar -s https://www.wevul.com @/etc/passwd...

W&B Weave Server - Remote Arbitrary File Leak

The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin. id:...

wholeaked

はじめに root@kitploit: , ,' ', Utku Sen's |,-' wholeaked /c '\ ' |' -. "When you have eliminated the impossible, /-' \ whatever remains, however improbable, /'-'\ must be the truth" - Sherlock Holmes ' \ wholeaked は、情報漏洩が発生した際に責任者を特定できるファイル共有ツールです。Go で書かれています。 仕組み wholeaked...

CVE-2024-23897

CVE-2024-23897 Jenkins 임의 파일 유출 취약점 CVE-2024-23897 !CAUTION ⚠️ 면책 조항: 중요: 이 스크립트는 교육, 윤리적 테스트 및 합법적인 용도로만 제공됩니다. 명시적 허가 없이 시스템이나 네트워크에 사용하지 마십시오. 컴퓨터 시스템 및 네트워크에 대한 무단 액세스는 불법이며, 무단 활동을 수행하는 사용자는 법적 조치를 받을 수 있습니다. 작성자는 이 스크립트의 오용으로 인해 발생하는 어떠한 손해에도 책임을 지지 않습니다...

CVE-2024-28000

LiteSpeed Cache Privilege Escalation Exp CVE-2024-28000Scan.py このスクリプトはまずバージョンを識別し、脆弱なバージョンかどうかを判断します。その後、ログファイルが存在するか確認し、存在する場合はパケットを送信して再度ログファイルをリクエストし、ハッシュ漏洩を探します。LiteSpeedがデバッグを有効にしている場合、正しいハッシュが漏洩する可能性があります。 root@kitploit: usage: CVE-2024-28000Scan.py -h -f F -t T -p PROXY CVE-2024-28000 Sca...

CVE-2024-23897-Jenkins-4.441

CVE-2024-23897 - Jenkins 任意文件泄露 编译 root@kitploit: g++ CVE-2024-23897.cpp -o exploit 使用方法 root@kitploit: /exploit -u http://10.10.10.10 -f /etc/passwd...

CVE-2024-14027_slop

CVE-2024-14027 - SlopSploit 이 익스플로잇은 6.6.51 커널에서 Qemu debian 설치를 사용하여 테스트되었습니다. exploit.c - shadow 파일을 유출합니다. exploitdc.c - 더블 클로즈double close 방식을 시연하여 루트 셸을 획득합니다. WRITEUP.md - LLM이 생성한 분석 보고서입니다. 이 프로젝트는 LLMOpus 4.6을 사용하여 grsecurity에서 설명한 동일 유형 객체 재사용same-type object reuse 취약점을 악용하는 실험이었습니다...

EUVD-2026-62902

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could read JavaScript files outside the Splunk Web static directory. The vulnerability is possible because Splunk Web does not restrict static file requests to the configured static directory...

CVE-2026-75914

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool. The root cause is a failure to canonicalize symlinks before reading files, allowing an attacker to create workspace symlinks pointing to external files with image extensions. This enables arbitrary ...

CVE-2026-75914 CodeWhale before 0.8.64 Path Traversal via image_analyze symlink

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the imageanalyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without use...

CVE-2026-75914

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the imageanalyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without use...

EUVD-2026-60972

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the imageanalyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without use...

CVE-2026-18549

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client then aborts t...

CVE-2026-19474

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that...

EUVD-2026-59761

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that...

CVE-2026-19474 @fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that...

CVE-2026-19474

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that...

CVE-2026-19474 @fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that...

CVE-2026-19474

The CVE-2026-19474 entry concerns @fastify/multipart, affecting versions 3.0.0 up to but not including 10.1.1. The root cause is that request.saveRequestFiles() can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts; the iterato...

CVE-2026-18549 @fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client then aborts t...