sshpass-win32

sshpass-win32 https://linux.die.net/man/1/sshpass 와 유사합니다. 사전 요구사항 sshpass를 실행하려면 다음을 설치해야 합니다: Windows 10 Insider 빌드 17733 이상 설치 Winget winget install xhcoding.sshpass-win32 Scoop scoop install sshpass 사용법 Usage: sshpass options command arguments -h, --help show this help message and exit -V,...

SharpSploitConsole

SharpSploitConsole @cobbrio가 공개한 SharpSploit과 상호작용하도록 설계된 콘솔 애플리케이션 https://github.com/cobbr/SharpSploit SharpSploit은 @cobbrio가 만든 도구로, 정보 보안 커뮤니티의 다양한 기술/C 코드를 하나의 멋진 DLL로 결합한 것입니다. 정말 훌륭하니 꼭 확인해보세요! 설명 SharpSploit Console은 단순한 개념 증명 바이너리로, C 경험이 적은 침투 테스터나 레드 팀이 SharpSploit의 멋진 기능 중 일부를 사용해볼 수...

CVE-2024-30088__Windows-TOCTOU-exploit

CVE-2024-30088 – WinRM 向け改変 PoC 📌 概要 これは元の CVE-2024-30088 エクスプロイトを改変したバージョンで、非対話型環境 WinRM で動作するように調整されています。 元の PoC は対話型の cmd.exe を起動するため、WinRM 上では動作しません。 このバージョンは非対話型での実行と安定性 に重点を置いています。 🔧 元の PoC からの変更点 CREATENEWCONSOLE を CREATENOWINDOW に置き換え WaitForSingleObject を追加し、同期実行を保証 WinRM...

CVE-2009-4623

CVE-2009-4623 CVE-2009-4623 のリモートシェル: 非対話型シェルを取得し、高度な使用のために別のシェルを開きます !!! 使い方: CVE-2009-4623.sh hostnameandPath 例: CVE-2009-4623.sh http://192.168.1.24/advancedcommentsystem/admin.php オプション: -h このガラクタ...

CVE-2026-18733 Prompt injection bypasses shell tool consent gate in Strands Agents Tools

A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the noninteractive parameter to true, bypassing the human consent gate. To...

Broken Gates: Re-Evaluating Web Bot Defenses in the Age of LLM Agents

LLM-based browser agents are rapidly changing the threat landscape for web security. Unlike traditional automation frameworks that execute predefined scripts, these agents can autonomously navigate websites, reason about page content, and interact with web interfaces using natural-language...

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the ssh process. An attacker can execute arbitrary commands on the operator's workstation by injecting malicious OpenSSH options when the operator runs non-interactive SSH commands. Remediation Upgrade...

CVE-2026-47829

CVE-2026-47829 describes an argument injection flaw in bosh-cli that lets a compromised BOSH Director inject arbitrary OpenSSH options into the locally-spawned ssh process when operators run non-interactive SSH paths (e.g., bosh ssh -c, bosh logs -f). This can lead to local command execution on t...

PT-2026-56706

Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH options into the locally-spawned ssh process when an operator runs bosh ssh -c, bosh logs -f, or other non-interactive SSH paths, leading to local command execution on the operator's workstation. Affecte...

Ghost without Shell: Measuring Non-Interactive SSH Attacks on Honeypots

Cyber deception research has focused on improving honeypot deception capabilities to increase attacker engagement and extend their interactions to collect more and better intelligence. For SSH honeypots, this relies on the assumption that attackers log in, open a shell, and type. We tested whethe...

EUVD-2026-39016

Warp is an agentic development environment. From 0.2025.10.08.08.12.stable00 until 0.2026.05.06.15.42.stable01, Warp contains a command execution permission-check bypass in the default unsandboxed CLI agent profile. The CLI profile is non-interactive and relies on a command denylist as a safety...

CVE-2026-48721 Warp: Env-var prefixes can lead to denylisted command autoexecution

Warp is an agentic development environment. From 0.2025.10.08.08.12.stable00 until 0.2026.05.06.15.42.stable01, Warp contains a command execution permission-check bypass in the default unsandboxed CLI agent profile. The CLI profile is non-interactive and relies on a command denylist as a safety...

CVE-2026-48721 Warp: Env-var prefixes can lead to denylisted command autoexecution

Warp is an agentic development environment. From 0.2025.10.08.08.12.stable00 until 0.2026.05.06.15.42.stable01, Warp contains a command execution permission-check bypass in the default unsandboxed CLI agent profile. The CLI profile is non-interactive and relies on a command denylist as a safety...

CVE-2026-48721

Warp: The default unsandboxed CLI agent profile uses a command denylist as a safety boundary. From 0.2025.10.08.08.12.stable_00 to 0.2026.05.06.15.42.stable_01, Warp’s command output can be influenced by environment-variable prefixes, causing denylisted commands to be treated as allowed. This byp...

claude-code-f002-poc

F002: Supply Chain Attack via Non-Interactive Workspace Trust...

CVE-2026-44479

Vercel’s AI Cloud is a unified platform for building modern applications. From 50.16.0 to 52.0.0, hen the Vercel CLI runs in non-interactive mode --non-interactive or auto-detected AI agent, commands that cannot complete autonomously emit JSON payloads with suggested follow-up commands. If the us...

MAL-2026-4212 Malicious code in polymarket-claude-code (npm)

A coordinated supply-chain attack comprising 9 npm packages published by maintainer polymarketdev GitHub actor texsellix, repo texsellix/polymarket-trading-bot within a 2-minute window on 2026-05-20T23:30Z–23:32Z. All packages masquerade as legitimate Polymarket CLOB trading tools while...

MAL-2026-4729 Malicious code in whiteboard-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae14bab8e5a11636f7a395fccf88119f5294c3639c8f71b6b2e3f199282bb584 On npm install, scripts/postinstall.js fetches a companion-- binary from github.com/palmthree-studio/whiteboard-agent/releases/download/nightly/... —...

The vulnerability of the Craft CMS content management system, related to the use of a signal processor for an non-interactive function, allows attackers to execute arbitrary commands.

The vulnerability of the Craft CMS content management system is related to the use of a signal processor for non-interactive functions. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

CVE-2026-44479

Vercel’s AI Cloud is a unified platform for building modern applications. From 50.16.0 to 52.0.0, hen the Vercel CLI runs in non-interactive mode --non-interactive or auto-detected AI agent, commands that cannot complete autonomously emit JSON payloads with suggested follow-up commands. If the us...