CVE-2024-22120-RCE-with-gopher

사용법 python exploit.py --ip --sid --hostid --phpsessid --falsetime --truetime 예제 시나리오 IP 192.168.1.100에서 실행 중인 Zabbix 서버를 발견했으며, 다음과 같은 세부 정보를 가진 낮은 권한의 사용자에 접근할 수 있습니다: 세션 ID sid: d82bf6715e1d3c1f25 호스트 ID hostid: 10107 PHP 세션 ID phpsessid: a4g7f48d9j3r7h8s9g 이 스크립트를 사용하여 RCE 취약점을 악용하려고 합니다. 스크립트...

W&B Weave Server - Remote Arbitrary File Leak

The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin. id:...

CVE-2024-3183-POC

CVE-2024-3183-POC CVE-2024-3183 FreeIPA Rosting에 대한 POC 영향: 저권한 사용자가 모든 도메인 사용자의 비밀번호 해시를 획득하고 오프라인 무차별 대입 공격kerberoasting을 수행할 수 있습니다. impacket-getTGT 패치: 1. impacket/krb5/kerberosv5.py에 decoder.decode.defaultErrorState = stGetValueDecoderByTag를 추가합니다. 2. 즐기세요! POC1: 1...

MAL-015

MAL-015: Ansible Tower における Isolation Escape 2 特定の Rhel 7/8 環境にインストールされた Ansible Tower は、「Job Isolation」エスケープに対して脆弱である可能性があり、攻撃者が隔離環境の外部から「awx」ユーザーへ権限昇格できる可能性があります。 以下のファイル/セットアップは、CVE-2021-20253 がパッチ適用された後、攻撃者が Job Isolation エスケープの脆弱性を実行するために悪用できるものです: ファイル「/var/spool/mail/awx」: ターゲットに SMTP...

CVE-2026-5173

🦊 CVE-2026-5173: GitLab WebSocket 무단 메서드 실행 PoC 🛠️ 개요 CVE-2026-5173 은 낮은 권한의 인증된 공격자가 GitLab의 WebSocket/-/cable 엔드포인트, 특히 GraphqlChannel을 통해 제한된 백엔드 메서드를 호출할 수 있게 합니다. 이로 인해 민감한 데이터 노출높은 기밀성 및 제한된 무단 작업이 발생할 수 있습니다. 영향을 받는 버전 GitLab CE/EE: 16.9.6 18.8.8 18.9 18.9.5 미만 18.10 18.10.3 미만 패치 적용 버전 :...

CVE-2026-86105

An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different resource which they are authorized to...

CVE-2026-100287

Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently delete or restore vault attachments via a crafted API request...

CVE-2026-93332

Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, modify, and delete System Vault entries via a crafted API request...

CVE-2026-101267

A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue...

CVE-2026-101267

A missing permission check allows low-privileged users who have access to an event, but lack access to its orders, to extract specific information. This vulnerability leads to a revenue information leak , exposing details such as the total revenue and the number of attendees . No specific softwar...

CVE-2026-101267 Revenue information leak

A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue...

CVE-2026-101267 Revenue information leak

A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue...

Server-Side Request Forgery

Apache Shiro is vulnerable to Server-Side Request Forgery. The vulnerability is due to insufficient validation of the form‑resubmit target in the Jakarta EE integration module, where the server will initiate an outbound connection to a URL supplied in a crafted HTTP request and transmit...

CVE-2021-20253

CVE-2021-20253: Ansible Tower의 Job Isolation 탈출을 통한 권한 상승 ansible-tower에서 결함이 발견되었습니다. 기본 설치는 Job Isolation 탈출에 취약하여 공격자가 격리된 환경 외부에서 낮은 권한의 사용자에서 awx 사용자로 권한을 상승시킬 수 있습니다. 이 취약성으로 인한 가장 큰 위협은 데이터 기밀성과 무결성, 그리고 시스템 가용성입니다. 공급업체 공개: 이 취약성에 대한 공급업체의 공개 및 수정 사항은 여기에서 확인할 수 있습니다. 요구 사항: 이 취약성을 악용하려면...

Linux Distros Unpatched Vulnerability : CVE-2026-55217

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low- privileged authenticated user can create, update, or delete...

Linux Distros Unpatched Vulnerability : CVE-2026-53627

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API v2 to perform update...

CVE-2026-34213

CVE-2026-34213 Docmost의 권한이 낮은 사용자가 피해자의 attachmentId를 일반 업로드 엔드포인트에 제공하고 동일한 워크스페이스 내 다른 페이지의 저장된 첨부 파일을 덮어쓸 수 있습니다. 소개 저는 Docmost오픈소스 협업 문서화 플랫폼에서 High 심각도의 인가 결함을 식별하고, 책임감 있게 공개했으며, 재현했습니다. Docmost의 공식 사이트는 이 플랫폼을 300만 회 이상 다운로드 된 엔터프라이즈급 온프레미스 위키로 소개하며, Vilnius City , Bechtle , 호주 정부 , 적십자 ,...

CVE-2026-53627

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API v2 to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently...

UBUNTU-CVE-2026-55217

GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected content. This issue is fixed in versions 11.0...

CVE-2026-55217

The asset and IT management software GLPI is vulnerable to an authorization bypass in versions 0.85 until 10.0.26 and 11.0.8 . A low-privileged authenticated user can perform unauthorized actions, including creating, updating, or deleting knowledge base comments and translations . This issue is a...