479760 matches found
Triage-CVE-2021-44228-Log4Shell-Log4j-
Triage: CVE-2021-44228 Log4Shell / Log4j In questo laboratorio, l'obiettivo era fare il triage di un'altra vulnerabilità reale e ben nota, Log4Shell, una delle vulnerabilità più sfruttate degli ultimi anni a causa di quanto fosse diffusa la libreria interessata nel software aziendale. Passo 1:...
PoC
PoC Repository di exploit proof of concept e strumenti. BMCRSCDRCE Exploit di esecuzione remota di comandi non autenticato per l'agente RSCD di BMC Server Automation. L'exploit funziona contro i server affetti da CVE-2016-1542 rilevato da Nessus. Questo è ora un modulo Metasploit, vedi...
-CVE-2014-6271-Shellshock-Remote-Command-Injection-
CVE-2014-6271 Shellshock-Remote-Command-Injection CVE-2014-6271 Strumento Apache Shellshock per l'iniezione di comandi da remoto, per una reverse shell rapida e la navigazione nei file root@kitploit: Shellshock Apache remote exploit Usage: ./Shellshock.py payload=reverse rhost=1.2.3.4 page=3...
Exploits
Exploit POC di exploit per mondo reale e CTF. Mondo Reale CVE| Descrizione breve| Exploit ---|---|--- CVE-2017-5343| SQL Injection in Wordpress| POC CVE-2018-8880| Esfiltrazione di informazioni di rete non autenticata per Lutron Quantum Bacnet v2| POC CVE-2018-11629| Credenziali predefinite e non...
GHSA-3G44-3M7X-CGG2 Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`
Overview Yamcs compiles StreamSQL expressions to Java on the fly with the Janino SimpleCompiler no restrictive class-loading policy or expression sandbox. When a StreamSQL aggregate such as sum... is applied to a column, the column's name is interpolated unescaped into the generated Java source...
Arbitrary Code Injection
Overview Affected versions of this package are vulnerable to Arbitrary Code Injection in the executeSql process. An attacker can execute arbitrary code with the privileges of the server process by injecting malicious Java code into a column name, which is then compiled and executed by the...
Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`
Overview Yamcs compiles StreamSQL expressions to Java on the fly with the Janino SimpleCompiler no restrictive class-loading policy or expression sandbox. When a StreamSQL aggregate such as sum... is applied to a column, the column's name is interpolated unescaped into the generated Java source...
CVE-2026-77939 Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint
Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint...
CVE-2026-77939
Flextype CMS through v1.0.0-dev is affected by an expression language injection in its Symfony ExpressionLanguage engine , reachable via the POST /api/v1/query endpoint. Unsanitized, user-supplied input is passed to the engine, exposing application objects such as filesystem() and serializers() w...
EUVD-2026-67837
Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint...
CVE-2026-55511 Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCodeInputDefVars and Expression.sanitizeName. A sum aggrega...
EUVD-2026-67836
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCodeInputDefVars and Expression.sanitizeName. A sum aggrega...
CVE-2026-55511 Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCodeInputDefVars and Expression.sanitizeName. A sum aggrega...
CVE-2026-55511
Yamcs is a mission control framework. In versions prior to 5.12.8 and 5.13.2 , an authenticated user holding the SystemPrivilege.ControlArchiving privilege can inject arbitrary Java into the StreamSQL aggregate expression compiler by crafting a malicious double-quoted column name. The column name...
CVE-2024-4577
CVE-2024-4577 - Iniezione di Argomenti PHP-CGI RCE | | ---|---|--- CVE| Descrizione| CVSSv3 CVE-2024-4577| Vulnerabilità di Iniezione di Argomenti PHP-CGI| 9.8 | | "CVE-2024-4577 è una vulnerabilità critica di iniezione di argomenti in PHP che può essere sfruttata per ottenere esecuzione remota d...
dell-emc_recoverpoint
Dell EMC RecoverPoint Exploit per una piattaforma enterprise di protezione dati Ho scoperto le seguenti vulnerabilità nella piattaforma enterprise di protezione dati RecoverPoint, menzionate nella divulgazione di Dell EMC. http://seclists.org/fulldisclosure/2018/May/61 Esecuzione remota di codice...
CVE-2026-66748-Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field
Security Advisory: Camaleon CMS - RCE autenticata tramite campo personalizzato selecteval ID CVE assegnato: CVE-2026-66748 Prodotto: Camaleon CMS https://github.com/owen2345/camaleon-cms Versioni interessate: 2.1.1 – 2.9.1 introdotta dal commit 415cbda6 del 2015-10-16; corretta dal commit 1588236...
reports
Dieser Ordner enthält einige Schwachstellenberichte, die ich im Laufe der Zeit offengelegt habe. Barracuda Networks Load Balancer ADC - Mehrere Schwachstellen CVE-2014-8426, CVE-2014-8428 Aruba ClearPass Policy Manager - Stored XSS CVE-2015-1389 Network Solution WebMail - Mehrere Schwachstellen...
VertXploit
VertXploit Exploit dei sistemi di controllo accessi HID VertX e EDGE Riepilogo VertXploit è uno strumento che può essere utilizzato per sfruttare i sistemi di controllo accessi HID VertX e EDGE. Esiste una vulnerabilità nel servizio discoveryd, che non riesce a sanificare i dati dell'utente prima...