vulhub

This is an open-source collection of vulnerable web applications and environments for security research and training. It is a repository of vulnerable systems, including web applications, databases, and other software, designed to help security professionals and researchers practice and improve...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Apache-Log4j-POC CVE-2021-44228 Proof of Concept of apache log...

RubyGems: Dependency repository hijacking aka Repo Jacking from GitHub repo rubygems/bundler-site & rubygems/bundler.github.io + bundler.io docs

Dependency repository hijacking aka repo jacking is an obscure supply chain vulnerability, conceptually similar to subdomain takeover. When the linked repository owner changes their username, it becomes immediately available to be re-registered by anyone. This means that any project that linked...

Apache Log4j2 2.14.1 Remote Code Execution

Exploit Title: Apache Log4j 2 - Remote Code Execution RCE Date: 11/12/2021 Exploit Authors: kozmer, z9fr, svmorris Vendor Homepage: https://logging.apache.org/log4j/2.x/ Software Link: https://github.com/apache/logging-log4j2 Version: versions 2.0-beta-9 and 2.14.1. Tested on: Linux CVE:...

CVE-2021-24915

creationtimestamp| type| source ---|---|--- 2021-11-29 12:33:06+00:00| seen| https://t.me/cibsecurity/33013 2023-10-17 12:50:28+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-24915.yaml 2026-03-12 21:02:31+00:00| seen|...

CVE-2021-43495

creationtimestamp| type| source ---|---|--- 2021-11-17 16:14:39+00:00| seen| https://t.me/cibsecurity/32451 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-43495.yaml...

Kubernetes: Broken Link Takeover from kubernetes.io docs

Report Submission Form Summary: Kubernetes docs has Spanish translation available. One of the page of Portuguese doc has an external reference to a github repository. The github account was not registered on github.com. So I was able to takeover the page and host the PoC Kubernetes Version: NA...

CVE-2021-24791

creationtimestamp| type| source ---|---|--- 2021-11-08 20:29:16+00:00| seen| https://t.me/cibsecurity/31991 2023-10-17 12:50:28+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-24791.yaml...

CVE-2021-39341

creationtimestamp| type| source ---|---|--- 2021-10-29 18:01:00+00:00| seen| https://t.me/truesecator/2269 2021-10-31 16:24:28+00:00| exploited| https://t.me/CyberSecurityTechnologies/4637 2021-11-01 23:21:31+00:00| seen| https://t.me/cibsecurity/31573 2025-06-09 13:12:57+00:00| confirmed|...

GHSA-M836-GXWQ-J2PM Improper Access Control in github.com/treeverse/lakefs

Impact 1. medium A user with write permissions to a portion of a repository may use the S3 gateway to copy any object in the repository if they know its name. 1. medium A user with permission to write any one of tags, branches, or commits on a repository may write all of them. 1. low A user with...

CVE-2021-40542

creationtimestamp| type| source ---|---|--- 2021-10-11 16:23:31+00:00| seen| https://t.me/cibsecurity/30335 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-40542.yaml...

Exploit for Path Traversal in Apache Http_Server

Apachuk - CVE-2021-41773 Grabber with Shodan Grabber Apache Di...

CVE-2021-30175

creationtimestamp| type| source ---|---|--- 2021-09-21 06:42:48+00:00| published-proof-of-concept| https://t.me/pwnwikizhchannel/153 2023-04-27 17:01:53+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-30175.yaml...

Wrong type for `Linker`-define functions when used across two `Engine`s

Impact As a Rust library the wasmtime crate clearly marks which functions are safe and which are unsafe, guaranteeing that if consumers never use unsafe then it should not be possible to have memory unsafety issues in their embeddings of Wasmtime. An issue was discovered in the safe API of...

CVE-2021-37416

creationtimestamp| type| source ---|---|--- 2021-08-30 22:32:38+00:00| seen| https://t.me/cibsecurity/28023 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-37416.yaml...

CVE-2021-37538

creationtimestamp| type| source ---|---|--- 2021-08-24 16:23:27+00:00| seen| https://t.me/cibsecurity/27767 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-37538.yaml 2024-01-16 07:48:45+00:00| seen|...

GHSA-H563-XH25-X54Q Workflow re-write vulnerability using input parameter

Impact Allow end-users to set input parameters, but otherwise expect workflows to be secure. Patches Not yet. Workarounds Set EXPRESSIONTEMPLATES=false for the workflow controller References https://github.com/argoproj/argo-workflows/issues/6441 For more information If you have any questions or...

Sharing the first SimuLand dataset to expedite research and learn about adversary tradecraft

Last month, we introduced the SimuLand project to help security researchers around the world deploy lab environments to reproduce well-known attack scenarios, actively test detections, and learn more about the underlying behavior and implementation of adversary techniques. Since the release of th...

CVE-2021-32789

creationtimestamp| type| source ---|---|--- 2021-07-26 20:11:30+00:00| seen| https://t.me/cibsecurity/26495 2021-10-28 11:07:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/4617 2023-04-27 09:58:59+00:00| confirmed|...

Ian Dunn: Multiple server ssh usernames leaked in your github repository

hi security team,while searching on github,I have found multiple ssh usernames that belongs to your organization are exposed in the organization github repository STEPS TO REPRODUCE:- 1.Go to this repository. you will see the leaked multiple server ssh usernames...