PPLFault

PPLFault Di Gabriel Landau presso Elastic Security. Da PPLdump Is Dead. Long Live PPLdump! presentato a Black Hat Asia 2023. PPLFault AGGIORNAMENTO 2024-02: Microsoft ha corretto PPLFault il 2024-02-13. Vediquesto thread per la discussione correlata. Sfrutta un TOCTOU in Windows Code Integrity pe...

impersonate-rs

IRS Impersonate-RS 💡 IRS è una versione libreria di https://github.com/zblurx/impersonate-rs, zblurx Reimplementazione di Defte Impersonate in puro Rust. Per maggiori informazioni, consulta questo post del blog. L'approccio all'impersonazione dei token è leggermente diverso da quello di Defte...

UniPwn

Analisi dell'iniezione di comandi del servizio BLE del robot Unitree Autore: Bin4ry aka Andreas Makris [email protected] Coautore: h0stile aka Kevin Finisterre Contributore: legion1581 aka Konstantin Severov di theroboverse ha contribuito a correggere il payload per l'iniezione e lo ha...

PowerShell-Suite

PowerShell-Suite В интернете есть отличные инструменты и ресурсы для выполнения большинства задач в PowerShell, однако иногда возникает необходимость собрать утилиту для конкретной цели или заполнить онтологический пробел. Это набор PowerShell-утилит, которые я собрал либо ради интереса, либо...

routers-exploit

OpenSource-репозиторий с PoC и уязвимостями, найденными в роутерах TP LINK TL-WR849N - PoC удаленного выполнения команд CVE-2020-9374 - TP LINK TL-WR849N - PoC удаленного выполнения команд root@kitploit: Полезная нагрузка: "$ls" TP LINK TL-WR849N - Обход аутентификации: обновление прошивки и...

Shiro_Xray

ShiroXray Gadget root@kitploit: CommonsBeanutils1 CommonsCollectionsK1 CommonsCollectionsK2 Getshell: Ледяной Скорпион root@kitploit: import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet; import java.io.PrintWriter; import java.net.URLDecoder; import sun.misc.BASE64Decoder;...

rosettaflash

Rosetta Flash CVE-2014-4671 Adobe Flash Player до версии 13.0.0.231 и 14.x до 14.0.0.145 на Windows и OS X, а также до версии 11.2.202.394 на Linux, Adobe AIR до 14.0.0.137 на Android, Adobe AIR SDK до 14.0.0.137 и Adobe AIR SDK & Compiler до 14.0.0.137 не накладывают должных ограничений на форма...

wordpress-exploits

wordpress-exploits यादृच्छिक वर्डप्रेस एक्सप्लॉइट्स काम कर सकते हैं या नहीं भी। CVE-2019-19985 जानकारी root@kitploit: Description: Unauthenticated File Download w/ Information Disclosure CVE ID: CVE-2019-19985 CVSS v3.0 Score: 5.8 Medium CVSS Vector String:...

PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI

Vulnerability Details A reflected JSON injection allows an attacker to return arbitrary data in the JSON endpoints like /?jsonld= and /?pasteid. Root Cause Request::getRequestUri sanitizes $SERVER'REQUESTURI' with FILTERSANITIZEURL: php public function getRequestUri $uri =...

GHSA-XRJC-C68J-HP7W PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI

Vulnerability Details A reflected JSON injection allows an attacker to return arbitrary data in the JSON endpoints like /?jsonld= and /?pasteid. Root Cause Request::getRequestUri sanitizes $SERVER'REQUESTURI' with FILTERSANITIZEURL: php public function getRequestUri $uri =...

GHSA-F2XF-7X3G-4272 PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction

Summary Stored cross-site scripting XSS in PrivateBin's attachment download link. An anonymous attacker can create a paste with a text/html attachment that, with certain user interaction, bypasses protections similar to CVE-2022-24833. When a victim opens the "Download attachment" link in a new...

PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction

Summary Stored cross-site scripting XSS in PrivateBin's attachment download link. An anonymous attacker can create a paste with a text/html attachment that, with certain user interaction, bypasses protections similar to CVE-2022-24833. When a victim opens the "Download attachment" link in a new...

CVE-2026-82284

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/chatid/history, DELETE /chat/chatid, and POST /chat/chatid/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary...

CVE-2026-82273

Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and...

CVE-2026-82263

Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Tenant administrators with Management API credentials can supply arbitrary internal URLs to trigger HTTP GET requests to private...

CVE-2026-75124

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termination, allowing parsequerystring to process...

CVE-2026-55565

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCodegetValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through...

CVE-2026-55547

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java. Any authenticated account can call GET /api/roles, GET...

CVE-2026-55549

Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirecturi parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.ja...

CVE-2026-55485

Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccoloadmin/endpoints.py uses superuservalidators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET requests to configured user and session table...