30 matches found
cve-2018-8611
CVE-2018-8611 KTM UAF 权限提升漏洞利用 这是我为 CVE-2018-8611 编写的 PoC 提权漏洞利用， 我在学习 ost2 windows 内核利用课程时写下了这个漏洞利用。 我非常喜欢这门课程，以及它循序渐进的教学方式和所提供的示例， 所以这是我自己的版本。我尽量不照搬课程提供的利用代码， 尽管不得不花几个小时调试各种奇怪的内核 bug， 但我确信自己无论如何都会完成它，所以我一直坚持了下来 :D 该漏洞利用实现了两种方式：较简单的方式是通过 write 0 原语覆盖 PreviousMode 字段， 以及递增原语技术。如果你使用 -w 参数运行该漏洞利用，...
CVE-2026-35096
KTM System e-BOK is vulnerable to Cross‑Site Request Forgery CSRF in both the email-change and password-change functionalities. An attacker can craft a malicious website that, when visited by an authenticated user, automatically sends a forged POST request to the application. This allows the...
CVE-2026-35097
KTM System e-BOK enforces a maximum password length of six numeric digits and does not permit the use of any alphabetic, special, or extended characters. This issue was fixed in the patch published in June 2026...
CVE-2026-35098
KTM System e-BOK does not implement any limit or timeout on consecutive login attempts, allowing an attacker to perform unlimited authentication requests. This lack of rate‑limiting enables efficient brute‑force attacks against user accounts. When combined with vulnerability CVE-2026-35097, where...
CVE-2026-35098
KTM System e-BOK does not implement any limit or timeout on consecutive login attempts, allowing an attacker to perform unlimited authentication requests. This lack of rate‑limiting enables efficient brute‑force attacks against user accounts. When combined with vulnerability CVE-2026-35097, where...
CVE-2026-35097
The CVE affects KTM System e-BOK, where the password policy allows only numeric passwords up to six digits. Root cause is a restricted character set and short max length, resulting in weak credential requirements. The issue has been addressed by a patch published in June 2026. Remediation recomme...
CVE-2026-35098
KTM System e-BOK is affected by CVE-2026-35098 due to no rate limiting on login attempts, enabling brute-force attacks for user accounts. When paired with CVE-2026-35097 (six-digit numeric passwords), the risk increases. A patch was released in June 2026 to fix this issue. The CVSS metrics from C...
CVE-2026-35097 Weak Password Requirements in KTM System e-BOK
KTM System e-BOK enforces a maximum password length of six numeric digits and does not permit the use of any alphabetic, special, or extended characters. This issue was fixed in the patch published in June 2026...
CVE-2026-35097 Weak Password Requirements in KTM System e-BOK
KTM System e-BOK enforces a maximum password length of six numeric digits and does not permit the use of any alphabetic, special, or extended characters. This issue was fixed in the patch published in June 2026...
EUVD-2026-40323
KTM System e-BOK is vulnerable to Cross‑Site Request Forgery CSRF in both the email-change and password-change functionalities. An attacker can craft a malicious website that, when visited by an authenticated user, automatically sends a forged POST request to the application. This allows the...
CVE-2026-35096 Cross-Site Request Forgery (CSRF) in KTM System e-BOK
KTM System e-BOK is vulnerable to Cross‑Site Request Forgery CSRF in both the email-change and password-change functionalities. An attacker can craft a malicious website that, when visited by an authenticated user, automatically sends a forged POST request to the application. This allows the...
CVE-2026-35096
KTM System e-BOK is affected by a Cross-Site Request Forgery (CSRF) in the email-change and password-change functions. The issue allows an attacker to lure an authenticated user to a malicious site that issues forged requests to perform an email or password change without user interaction. Root c...
CVE-2026-35095 Session fixation in KTM System e-BOK
KTM System e-BOK allows the session identifier to be set by the client prior to authentication. If a cookie with a valid name is set, its value remains unchanged after successful login. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated session...
CVE-2026-35095
Technical details (affected products/components, root cause, impact, or remediation) are not publicly available in the provided documents. Monitor for updates.
ktm-occasion.fr Cross Site Scripting vulnerability OBB-3420065
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
ktm-occasion.fr Cross Site Scripting vulnerability OBB-3232078
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
ktm-albi.fr Cross Site Scripting vulnerability OBB-3232075
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
ktm-bike.pt Cross Site Scripting vulnerability OBB-1277047
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
arquivo.ktm-bike.pt Cross Site Scripting vulnerability OBB-1222209
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
ktm-bike.pt Cross Site Scripting vulnerability OBB-1217979
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...