CVE-2021-34473-scanner

CVE-2021-34473-scanner 扫描器用于CVE-2021-34473, ProxyShell, 微软Exchange本地部署漏洞 要逐台测试机器，请使用 scanner-CVE-2021-34473.bat： scanner-CVE-2021-34473.bat mail.exemple.fr 要同时测试多台机器，请使用 mass-scanner 并将要检查的IP/FQDN逐行添加到 servers-to-check.txt 中： mass-scanner-CVE-2021-34473.bat 根据Exchange版本的修补措施： Exchange 2019 CU10 下...

redsnarf

root@kitploit: . \ \ | / / / \ | // \ / |\ \ / \ \ \ \ | | \ // // |/ \ | / | | /| | || /\ / /| /| || / / / / / / [email protected] @redsnarf RedSnarf is a pen-testing / red-teaming tool by Ed Williams for retrieving hashes and credentials from Windows workstations, servers and...

CVE-2026-65838 Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because...

rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions

A flaw was found in the rsync-ssl wrapper script's TLS certificate validation. An on-path attacker can present self-signed or invalid certificates to intercept, decrypt, or tamper with encrypted sessions. Because rsync fails to validate the certificate against a trusted CA or verify hostname...

rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions

A flaw was found in the rsync-ssl wrapper script's TLS certificate validation. An on-path attacker can present self-signed or invalid certificates to intercept, decrypt, or tamper with encrypted sessions. Because rsync fails to validate the certificate against a trusted CA or verify hostname...

CVE-2022-23131

CVE-2022-23131 CVE-2022-23131 - SAML单点登录绕过 root@kitploit: fofa: app="ZABBIX-监控系统" && body="saml"...

SecOPD

SecOPD: Mitigación de inyecciones de prompts adaptativas mediante destilación on-policy Yibo Peng · Long Lian · David Wagner† · Sizhe Chen† † Supervisión conjunta. Artículo Página del proyecto Modelo Esta versión implementa la formulación final de KL de respuesta completa del artículo, también...

CVE-2026-43503

🚨 CVE-2026-43503 — DirtyClone（脏克隆） 当共享内存不再安全共享时。 一个因 Linux 网络协议栈中未正确传播SKBFLSHAREDFRAG 标志而导致的本地权限提升漏洞。 📖 概述 CVE-2026-43503 ，编号为 DirtyClone（脏克隆） ，是一个影响 Linux 内核网络子系统的高危本地权限提升（LPE）漏洞。 该漏洞的存在是因为多个套接字缓冲区（SKB）的分片复制例程在克隆或传输数据包分片时未能保留 SKBFLSHAREDFRAG 标志。...

root-dirtyc0w

root-dirtyc0w CVE-2016-5195 DirtyCow 根权限提升 Dirty COW 是 Linux 内核中的一个竞态条件漏洞。该漏洞存在于处理内存映射写时复制（COW）特性的内核函数中，被利用时可允许进程写入只读文件。 该漏洞的一个示例用例是，将任何 SUID（设置用户 ID）二进制文件（如 passwd 可执行文件）覆盖为一个不同的 ELF 可执行文件（我们创建的），该文件执行 /bin/sh 从而获取 root 权限（如本仓库所示）。 你可以在 Linux 中找到更多设置了 SUID...

ruby-RCE-CVE-2019-5420-

ruby 反序列化 （CVE-2019-5420） root@kitploit: https://github.com/PenTestical/CVE-2019-5420 参考： root@kitploit: 1 Ruby on Rails 命令执行漏洞payload实现过程 https://hackerone.com/reports/473888 Since ActiveSupport::MessageVerifier and ActiveSupport::MessageEncryptor use Marshal as the default serializer, I confirm...

CVE-2026-46331

🚨 CVE-2026-46331 - Linux 内核 COW 漏洞 Linux 内核 net/sched 部分写时复制 COW 页面缓存损坏 -orange?style=for-the-badge 一个由流量控制 tc 数据包编辑子系统中不正确的写时复制 COW 处理引起的 Linux 内核漏洞。 📖 概述 CVE-2026-46331 是一个影响 net/sched 数据包编辑 actpedit 子系统的 Linux 内核漏洞。 该漏洞产生的原因是内核在 实际数据包编辑偏移量被确定之前 就计算了可写的写时复制 COW...

CVE-2025-53770

CVE-2025-53770 SharePoint反序列化RCE PoC 严重 — 通过在Microsoft SharePoint Server中的不安全反序列化实现的未认证远程代码执行 CVE-2025-53770 描述 在本地部署的Microsoft SharePoint Server中反序列化不可信数据允许攻击者远程执行代码并入侵系统。Microsoft已知悉该漏洞正在被积极利用，并正在准备全面的更新。请确保已应用CVE文档中所述的缓解措施。 影响 ：未认证的攻击者可以实现远程代码执行，从而导致系统完全被入侵。 严重性 ：严重 概念验证...

Astra Linux – Vulnerability in exim4

Exim 4 before 4.94.2 allows exposure of file descriptors to an unintended control sphere, because rdainterpret uses a privileged pipe without the closeonexec flag...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: rcv: Fixed an oops caused by the irqsoff latency tracer. The tracehardirqson,off functions require the caller to properly set up the frame pointer. This is because these two functions use the macro CALLERADDR1 also known as...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: um: Add winch to winchhandlers before registering the winchIRQ. Registering a winchIRQ can lead to a race condition; an interrupt may occur before the winch is added to the winchhandlers list. If this happens, registerwinchirq ad...

Astra Linux – Vulnerability in Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Closures: Change BUGON to WARNON If a BUGON function is actually executed, it shouldn’t be considered a real BUG. For reference, this issue has occurred once during the continuous integration process. We will need more informatio...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Remove WARNON from functionfsbind This commit addresses an issue related to a kernel panic that occurs when paniconwarn is enabled. The issue is caused by the unnecessary use of WARNON in functionfsbind, which c...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: In the ftrace function, a potential warning was fixed in traceprintkseq during ftracedump. When ftracedumpone is called concurrently with reading from tracepipe, a WARNONONCE message can be triggered due to a race condition. The...

mt6985-CVE-2026-43499

CVE-2026-43499 失败记录：MT6985 适配尝试 结论 : 花了 68M tokens，没拿到 root。 原因 : KernelSnitch 时序攻击在 MTK Dimensity 9200 上不可靠，CONFIGPANICONOOPS=y 不给试错空间。 这篇文章记录了完整踩坑过程，供后人参考避坑。 背景...

Cisco SSM On-Prem <= 8-202206 - Password Reset Account Takeover

A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem SSM On-Prem could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. This vulnerability is due to improper implementation of the password-change process...