CVE-2026-34674

Adobe Substance 3D Sampler versions 5.1.3 and earlier are affected by a Heap-based Buffer Overflow (CWE-122) that can lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction , specifically that a victim must open a malicious file. Adobe rated th...

EUVD-2026-67082

Substance3D - Sampler versions 5.1.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

xzwhy

xzwhy root@kitploit: / / / / \ / /\ Questo progetto è una Proof of Concept POC compatibile con Kubernetes per CVE-2024-3094, che interessa XZ Utils. Vedi questo articolo per un'ottima analisi dell'origine e del funzionamento dell'exploit. AVVERTENZA ⚠⚠⚠ L'esecuzione di uno qualsiasi dei comandi...

CVE-2021-33699_Task_Hijacking

CVE-2021-33699TaskHijacking Cos'è? Un'app malevola e un'app vittima per esercitarsi sulla vulnerabilità CVE-2021-33699Task Hijacking. Riferimento https://naro-security.tistory.com/55...

CVE-2026-81700 openssl_encrypt before 1.4.9 GPG Signature Verification Bypass

opensslencrypt versions before 1.4.9 contain a signature verification vulnerability in gpgrunner.verifydetached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing key...

CVE-2024-37051

CVE-2024-37051 Analyse Überblick CVE-2024-37051 ist eine Schwachstelle, die in JetBrains' IntelliJ-basierten IDEs gefunden wurde und das GitHub-Plugin betrifft. Sie ermöglicht die unbefugte Offenlegung von GitHub-Zugriffstokens, wenn ein bösartiger Pull Request PR geladen wird. Technische Details...

CVE-2021-40444

CVE-2021-40444 PoC Generatore di documenti docx malevoli per sfruttare CVE-2021-40444 Esecuzione di codice remoto in Microsoft Office Word La creazione di questo script si basa sul reverse engineering del campione utilizzato in natura:...

CVE-2024-3094-info

CVE-2024-3094-info https://github.com/lockness-Ko/xz-vulnerable-honeypot https://tukaani.org/xz-backdoor/ - Risposta di Lasse Collin https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27...

CVE-2024-3094

CVE-2024-3094 È stato scoperto del codice malevolo nei tarball upstream di xz, a partire dalla versione 5.6.0. Attraverso una serie di complesse offuscazioni, il processo di build di liblzma estrae un file oggetto precompilato da un file di test camuffato presente nel codice sorgente, che viene p...

phishing_catcher

Phishing Catcher Catch possible phishing domains in near real time by looking for suspicious TLS certificate issuances reported to the Certificate Transparency Log CTL via the CertStream API. "Suspicious" issuances are those whose domain name scores beyond a certain threshold based on a...

Malicious code in ekx-report-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a980e97d1539649ea4a9921cfeb308833c80e0832c1515f3f8e3a71d0b085b78 On import, the package runs a setup routine that reads a session credential from /tmp/.sandboxtoken and issues an authenticated GET to...

MAL-2026-14555 Malicious code in ekx-report-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a980e97d1539649ea4a9921cfeb308833c80e0832c1515f3f8e3a71d0b085b78 On import, the package runs a setup routine that reads a session credential from /tmp/.sandboxtoken and issues an authenticated GET to...

blind-xxe-controller-CVE-2021-29447

Controller per Blind XXE Ho creato questo controller per la macchina metatwo di HackTheBox per sfruttare CVE-2021-29447, una vulnerabilità XXE di WordPress nella libreria multimediale che colpisce le versioni 5.7, 5.6.2, 5.6.1, 5.6, 5.0.11. dove un utente autenticato con la possibilità di caricar...

CVE-2020-15916

EN GenLANConfigAttack - एक PoC है जो CVE-2020-15916 का शोषण करने के लिए है, एक ऐसी भेद्यता जो डिवाइस की LAN कॉन्फ़िगरेशन में अनधिकृत परिवर्तनों की अनुमति देती है। विशेषताएँ LAN कॉन्फ़िगरेशन भेद्यता का शोषण करता है नेटवर्क सेटिंग्स बदलने के लिए दुर्भावनापूर्ण पेलोड भेजता है LAN पर नियंत्रण पाने के...

Two Alleged ‘TeamPCP’ Hackers Arrested in Australia

Authorities in Australia have arrested two men believed to be members of TeamPCP , a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever. In a statement released today, the Australian Federal Police AFP said two men...

Malicious code in rn-push-provisioning (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77239db1bdbbae9f987b93749d88f1ea172ac43523377e2a47a40a0e0177a023 The package's package.json declares a preinstall lifecycle script node beacon.js || true that runs automatically during npm install. beacon.js reads...

MAL-2026-14563 Malicious code in rn-push-provisioning (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77239db1bdbbae9f987b93749d88f1ea172ac43523377e2a47a40a0e0177a023 The package's package.json declares a preinstall lifecycle script node beacon.js || true that runs automatically during npm install. beacon.js reads...

CVE-2026-81625

A remote attacker with user privileges may use a malicious or compromised NASL vulnerability test VT on the affected products to trigger a stack buffer overflow and gain full access on the compromised system...

detections

detections Questa è una repository di informazioni che potrebbero essere utili per rilevare attività dannose nel proprio ambiente. Non è esaustiva e si prega di usarla a proprio rischio verificate i vostri risultati!...

EUVD-2026-66955

A remote attacker with user privileges may use a malicious or compromised NASL vulnerability test VT on the affected products to trigger a stack buffer overflow and gain full access on the compromised system...