enterpriseattack

enterpriseattack - MITRE의 Enterprise ATT&CK® MITRE ATT&CK 엔터프라이즈 데이터셋과 상호작용하기 위한 경량 Python 모듈입니다. 속도와 최소한의 종속성 덕분에 프로덕션 애플리케이션에서 사용하도록 제작되었습니다. 자세한 내용은 문서를 참조하세요. MITRE ATT&CK® MITRE ATT&CK®는 실제 관측에 기반한 적대자 전술과 기법에 대한 전 세계적으로 접근 가능한 지식 기반입니다. ATT&CK 지식 기반은 민간 부문, 정부, 사이버보안 제품 및 서비스 커뮤니티에서 특정 위협 모...

Hoverfly < 1.10.3 - Arbitrary File Read

Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The /api/v2/simulation POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary...

mig

MIG: Mozilla InvestiGator MIG is Mozilla's platform for investigative surgery of remote endpoints. ⚠️ Deprecation Notice ⚠️ Mozilla is no longer maintaining the Mozilla InvestiGator MIG project. Mozilla is also no longer making use of this code internally. You are welcome to use this code as is...

CVE-2019-9511_Priority-Churn-Data-Dribble

HTTP/2 CVE-2019-9511 & CVE-2019-9513 Lightweight Probes Репозиторий со скриптами контролируемой валидации поведения, связанного с CVE CVE-2019-9511 и CVE-2019-9513 , обе касаются векторов отказа в обслуживании в реализациях HTTP/2. Скрипты созданы для поддержки технических проверок в авторизованн...

pyobfuscate

pyobfuscate 파이썬 페이로드를 완전히 FUD로 만들기 위한 간단하고 효율적인 스크립트 참고: root@kitploit: 1. 어떤 페이로드도 VirusTotal.com에 업로드하지 마세요. 이 도구는 시간이 지나면 작동하지 않을 것입니다. 2. VirusTotal은 AV 회사들과 서명을 공유합니다. 3. 다시 말하지만, 바보가 되지 마세요! 설치 방법: root@kitploit: 1. git clone https://github.com/machine1337/pyobfuscate.git 2. cd pyobfuscate ...

CVE-2026-6789-Stack-Buffer-Overflow-in-Embedded-TLS-Certificate-Parser

9. CVE-2026-6789 – 組み込みTLS証明書パーサーにおけるスタックバッファオーバーフロー 概要 ある一般的な軽量TLSライブラリ（シミュレーション）には、細工された長さフィールドを持つX.509証明書のSubject Alternative Name拡張を解析する際に、スタックバッファオーバーフローが発生します。 深刻度: 重大 IoT/産業機器におけるRCE 脆弱なCパーサーとエクスプロイト root@kitploit: // tlsx509vuln.c include include include include // Vulnerable certificate...

webshell

webshell 简体中文 This is a webshell collection project Give someone a rose, there is a fragrance in your hand if you download this project, please also submit a shell This project covers various common scripts Such as: asp, aspx, php, jsp, pl, py If you submit a webshell, please do not change the na...

Astra Linux – Vulnerability in Samba

A vulnerability related to information leaks was discovered in Samba’s LDAP server. Due to missing access control checks, a authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store...

Astra Linux – Vulnerability in curl

There is an improper authentication vulnerability in curl versions 7.33.0 through and including 7.82.0. This vulnerability may allow for the reuse of OAUTH2-authenticated connections without ensuring that the connection was authentically verified with the same credentials used for this transfer...

CVE-2026-5855

Contiki-NG: LwM2M TLV parser in os/services/lwm2m/lwm2m-tlv.c (function lwm2m_tlv_read) ignores the caller’s buffer length and may read up to six bytes without bounds checks. The engine loop continues while bytes remain, so a crafted CoAP WRITE to any LwM2M endpoint whose final TLV supplies exact...

CVE-2026-5855 Contiki-NG LwM2M TLV Parser Out-of-Bounds Read via Unchecked Buffer Length in lwm2m_tlv_read

Contiki-NG's LwM2M TLV parser lwm2mtlvread in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller in lwm2m-engine.c iterates while there is at least one byte remaining, so a crafted CoAP...

CVE-2026-5855 Contiki-NG LwM2M TLV Parser Out-of-Bounds Read via Unchecked Buffer Length in lwm2m_tlv_read

Contiki-NG's LwM2M TLV parser lwm2mtlvread in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller in lwm2m-engine.c iterates while there is at least one byte remaining, so a crafted CoAP...

CVE-2026-71282

ChirpStack's SQLite-backend device tag filtering chirpstack/src/storage/device.rs, in both getcount and list interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format! macro , while only the tag VALUE is safely parameter-bound via Diesel's .bind...

Flowise RCE via SQLite Record Manager Node

============================================================================= Security Advisory elttam Topic: Flowise RCE via SQLite Record Manager Node Module: FlowiseAI/Flowise Disclosed: 24-Apr-2026 Credits: Alex Brown Affects: FlowiseAI/Flowise 3.1.2 I. Background Flowise AI is an open-source...

sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

CVE-2026-44617

Apache Zeppelin (LdapRealm) has a LDAP filter injection issue due to escaping using RFC 4514 (DN escaping) instead of RFC 4515 filter escaping. This incomplete fix affects Zeppelin versions 0.11.1, 0.11.2, and 0.12.0 and is a partial remediation of CVE-2024-31867. Upgrading to version 0.12.1 is r...

CVE-2026-57962

A flaw was found in Thunderbird. A remote attacker, by operating a malicious Lightweight Directory Access Protocol LDAP server, can cause a Thunderbird client to crash due to memory exhaustion. This occurs when a user's Thunderbird client is configured to query the malicious LDAP server for...

EUVD-2026-46821

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware component: OUD Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Unified...

EUVD-2026-46815

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware component: OUD Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Unified...

PT-2026-62561

Name of the Vulnerable Software and Affected Versions Oracle Unified Directory versions 12.2.1.4.0 Oracle Unified Directory versions 14.1.2.1.0 Description A flaw in the OUD Core component of Oracle Fusion Middleware allows a high privileged attacker with network access via LDAP to compromise the...