DomainMOD 4.13.0 - Cross-Site Scripting

DomainMOD 4.13.0 is vulnerable to cross-site scripting via reporting/domains/cost-by-owner.php in the "or Expiring Between" parameter. id: CVE-2020-20988 info: name: DomainMOD 4.13.0 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.13.0 is vulnerable to...

dash-uploader 0.1.0 - 0.7.0a2 - Denial-of-Service via flowTotalChunks

fohrloop dash-uploader v0.1.0 through v0.7.0a2 contains a remote code execution caused by improper handling in Upload function and maxfilesize parameter in dashuploader components, letting remote attackers execute arbitrary code, exploit requires crafted request. id: CVE-2026-38361 info: name:...

katana

A next-generation crawling and spidering framework Features • Installation • Usage • Scope • Config • Filters • Join Discord Features Fast And fully configurable web crawling Standard and Headless mode JavaScript parsing / crawling Customizable automatic form filling Scope control - Preconfigured...

Max

간단한 도구 모음으로 BloodHound 최대 활용하기 설명 새로운 릴리스: dpat - BloodHound 도메인 비밀번호 감사 도구 DPAT 간단한 도구 모음: get-info - Neo4j 데이터베이스에서 정보 목록 가져오기 mark-owned - 개체 목록을 소유로 표시 mark-hvt - 개체 목록을 고가치 대상으로 표시 query - 원시 Cypher 쿼리 실행 및 출력 반환 export - 도메인 개체의 모든 아웃바운드 제어 권한을 CSV 파일로 내보내기 del-edge - 데이터베이스에서 에지 삭제...

dcrawl

dcrawl dcrawl is a simple, but smart, multi-threaded web crawler for randomly gathering huge lists of unique domain names. How it works? dcrawl takes one site URL as input and detects all links in the site's body. Each found link is put into the queue. Successively, each queued link is crawled in...

bscan

:mag: an asynchronous target enumeration tool :magright: Synopsis bscan is a command-line utility to perform active information gathering and service enumeration. At its core, bscan asynchronously spawns processes of well-known scanning utilities, repurposing scan results into highlighted console...

CVE-2022-0847

DirtyPipe Exploit per la vulnerabilità DirtyPipe scritto e scoperto da Max Kellermann - https://dirtypipe.cm4all.com/ POC...

Rejetto HTTP File Server - Template injection

This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. id: CVE-2024-23692 info: name: Rejetto HTTP File Server - Template injection author: johnk3r severity: critical description: | This...

GhostLock-5.10

GhostLock 5.10 This is a kernel root exploit for the Amazon Fire Max 11 sunstone and the Fire TV Stick 4K Max 2nd Gen / 2023 karat, adapted from CVE-2026-43499 in CyberMeowfia. Supported devices Two devices are supported, both on Fire OS 8. Each has its own build target. Fire Max 11 sunstone Fire...

CVE-2023-44487

Ataque de Reset Rápido HTTP2: CVE-2023-44487 Exploit rápido para testar o ataque de reset rápido CVE-2023-44487. Nota: Apenas para fins educacionais Índice Instalação Uso Instalação Clone o repositório para sua máquina local usando Git, instale o poetry e execute o programa: root@kitploit: git...

CVE-2023-41993

CVE-2023-41993 漏洞利用 PoC 此存储库包含针对 CVE-2023-41993 漏洞的概念验证 PoC 漏洞利用代码。 此 PoC 展示了基于 po6ix 发布的 PoC 的有限读/写原语。 此 PoC 的演示可在此处找到。 如有任何问题、建议或疑虑，请提出 issue。: :8080 漏洞详情 CVE-2023-41993 是一个严重漏洞，根源于 WebKit 浏览器引擎，影响多种 Apple 产品。它在处理恶意网页内容时允许任意代码执行。更多详情请参阅公告以及修复此问题的 WebKit 提交。 漏洞利用概述 此 PoC 展示了任意读/写原语，推进了对...

bind: bind9: Potential memory usage beyond configured limits

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the...

DirtyPipe-BSI

Dirty...Was? Dies ist der Proof-of-Concept von Max Kellermann für Dirty Pipe, modifiziert, um das Root-Passwortfeld in /etc/passwd zu überschreiben und nach Erhalt einer Root-Shell wiederherzustellen. Hinweis: Ich beanspruche keine Anerkennung für das Auffinden dieser Schwachstelle oder das...

CVE-2026-7455

A maliciously crafted FLT file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process...

CVE-2026-16783

A maliciously crafted ABC file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process...

CVE-2026-19568

A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process...

CVE-2026-16782

A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...

CVE-2026-16781

A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this vulnerability to cause the application to terminate unexpectedly, resulting in a denial-of-service...

CVE-2026-19568

CVE-2026-19568 affects Autodesk 3ds Max through a memory corruption flaw in its SVG file parsing routine. A maliciously crafted SVG file, when opened by a user, can trigger the corruption and lead to arbitrary code execution in the context of the current process. The CVSS 3.1 score is 7.8 (HIGH) ...

CVE-2026-19568 SVG File Parsing Memory Corruption Vulnerability in Autodesk 3ds Max

A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process...