CVE-2022-35497

In Trimble's TM4WEB =22.2.0 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint. Specifically, the three cookies used for maintaining sessions are UID, rstring...

dirtyclone-CVE-2026-43503

CVE-2026-43503 — DirtyClone Linux local privilege escalation. A cloned skbuff loses the SKBFLSHAREDFRAG flag, so ESP in-place decryption writes into file-backed page-cache memory. The PoC patches /etc/passwd in cache to inject a uid-0 account and gives a root shell. Disk is never modified. Fixed ...

CVE-2026-24061-lab

CVE-2026-24061 — Reproduction Lab ⚠️ For educational purposes only. Isolated lab environment. Français ci-dessous Summary Critical authentication bypass CVSS 9.8 in GNU InetUtils telnetd ≤ 2.7. By injecting -f root as the USER variable via the Telnet NEWENVIRON option, an unauthenticated attacker...

CVE-2022-22706-poc

CVE-2022-22706 - Page-Cache Write The Arm Mali GPU driver hands userspace a CPU-writable mapping of pages it pinned read-only, so an unprivileged process gets a writable alias of the page cache backing a file it can only open ORDONLY. exploit.c blanks root's password field in the /etc/passwd page...

CVE-2025-21298

content This is a proof-of-concept for CVE-2025-21298 - Windows OLE Remote Code Execution Vulnerability CVSS 9.8. This is a memory corruption PoC , not an exploit. Full patch diff via ghidriff: LINK vulnerability The vulnerability is located in ole32.dll!UtOlePresStmToContentsStm. The purpose of...

Astra Linux – Vulnerability in Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: f2fs: A sanity check was added for the F2FSInlineDATA flag in the inode during garbage collection GC. The syzbot reports the following f2fs bug: ------------ Cut here ------------ Kernel BUG: At fs/f2fs/inline.c:258 CPU: 1 PID: 3...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Anonymous sets are never used with a timeout flag from the user space; this behavior should be rejected. An exception to this rule is when using NFTSETEVAL, to ensure that legacy metering mechanisms continue ...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: btrfs: replaced BUGON with error handling in updaterefforcow. Instead of using BUGON, simply return an error, log an error message, and abort the transaction if we encounter an extent buffer belonging to the relocation tree th...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: sctp: Detect and prevent references to a freed transport in sendmsg. sctpsendmsg reuses transports whenever possible by performing a lookup based on the socket endpoint and the message destination address. Then,...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fixed a rare race condition in gdlmputlock In gdlmputlock, there is a short period of time during which the DFLUNMOUNT flag is set, but the lockspace has not yet been released. During that period, dlm may still call gdlmast...

CVE-2025-41244

💻 Step-by-Step Technical Process Compile the Program bash Compile the C code into an executable gcc -o /tmp/httpd /tmp/CVE-2025-41244.c Make it executable chmod +x /tmp/httpd Test the Version Functionality bash Test the -v flag should print version and exit /tmp/httpd -v Test the -V flag should...

ai-vuln-rediscovery-nginx-cve-2026-42945

AI-Assisted Rediscovery of CVE-2026-42945 in nginx This repository documents a reproducible AI-assisted vulnerability rediscovery experiment against nginx ngxhttprewritemodule, later associated with CVE-2026-42945. The experiment is intentionally narrow. The vulnerable file,...

CVE-2021-1732

CVE-2021-1732 The vulnerability occurs in the Windows graphics driver win32kfull!NtUserCreateWindowEx function due to a desynchronization between kernel callback user-mode memory allocation and the setting of the tagWND-flag attribute. This allows an attacker to forge the tagWND-offset value,...

CVE-2017-12615-poc

-h View usage instructions...

cve-2025-29927

CVE-2025-29927 1. go to /api/flag 2. add x-middleware-subrequest: src/middleware:src/middleware:src/middleware:src/middleware:src/middleware as header 3. see response...

MAL-014

MAL-014: Authenticated Arbitrary File Read in VMware vCenter Server The “com.vmware.appliance.version1.system.update.set” API component is vulnerable to a flag injection attack that can be leveraged with the “com.vmware.showlog” plugin in order to read arbitrary files as the “root” user on the...

ctf-party

ctf-party What it is A library to enhance and speed up script/exploit writing for CTF players or security researchers, bug bounty hunters, pentesters but mostly focused on CTF by patching the String class to add a short syntax of usual code patterns. The philosophy is also to keep the library to ...

CVE-2020-26732

CVE-2020-26732 SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTPS session Description SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTP...

APT-Individual-Combat-Guide

Руководство по одиночным APT-операциям Многие считают, что发起 APT-атаку сложно, потому что не понимают, как она происходит. На самом деле, с развитием автоматизированных инструментов发起 APT-атаку довольно легко. Switch Switch to English Предыстория Этот репозиторий содержит код и команды из книги...

CVE-2026-43284-

CVE-2026-43284 Dirty Flag Local Privilege Escalation По состоянию на начало мая 2026 года Dirty Frag относится к уязвимости ядра Linux высокой степени серьёзности CVE-2026-43284 и CVE-2026-43500.Воздействие: позволяет непривилегированным пользователям получить root-доступ полный административный...