ProcessStomping

ProcessStomping ProcessOverwriting 的一种变体，用于在可执行文件的节区上执行 shellcode 这是什么 更详细的解释请参阅我的博客文章 Process Stomping 是 hasherezade 的 Process Overwriting 的一种变体，其优势在于将 shellcode 载荷写入目标节区，而不是将整个 PE 载荷写入宿主进程的地址空间。 以下是 ProcessStomping 技术的主要步骤： 1. CreateProcess - 将进程创建标志设置为 CREATESUSPENDED 0x00000004 以挂起进程的主线程。 2...

process_overwriting

Process Overwriting Process Overwriting is a PE injection technique, closely related to Process Hollowing and Module Overloading. With its help, you can replace the main executable not a DLL of the target process. It works only for a newly created process - injection to existing processes is not...

process_overwriting

进程覆写 进程覆写是一种 PE 注入技术，与进程空心化和模块重载密切相关。 借助它，你可以替换目标进程的主可执行文件（而非 DLL）。 它仅适用于新创建的进程——该技术不支持注入到现有进程。 警告：目标镜像的大小必须不小于有效载荷镜像的大小。 执行步骤： 1. 从良性文件创建一个挂起的进程（禁用 CFG） 2. 将有效载荷映射到内存，并覆写到原始映射的镜像上（不取消映射原始镜像） 3. 将进程的入口点更新为有效载荷的入口点 4. 恢复进程，执行被替换的 PE !IMPORTANT 阅读常见问题解答 演示： 演示有效载荷（demo.bin）注入到 Windows 计算器（默认目标）：...

CVE-2026-18439: Authorization Bypass Through User-Controlled Key

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutorquizbuildersave AJAX action due to missing validation that nested questionid, answerid, deletedquestionids, and...

CVE-2025-5548

Estudio técnico de la vulnerabilidad CVE-2025-5548 Introducción En este trabajo se analiza la vulnerabilidad CVE-2025-5548 , asociada a un desbordamiento de búfer en la pila presente en FreeFloat FTP Server v1.0. El objetivo principal del laboratorio es entender cómo se comporta una aplicación...

CVE-2021-32819

CVE-2021-32819 CVE-2021-32819 : SquirrellyJS mezcla datos de plantilla pura con opciones de configuración del motor a través de la API de renderizado de Express. Al sobrescribir opciones de configuración interna, se puede desencadenar ejecución remota de código en aplicaciones posteriores. Fuente...

BlackHat-Europe-2022

BlackHat-Europe-2022 Select Bugs From Binary Where Pattern Like CVE-1337-Days Resumen La revisión estática de código es una forma eficaz de descubrir variantes de vulnerabilidades y primitivas de explotación, pero dos de las tareas más desafiantes del análisis estático son la extracción eficaz de...

Session Fixation

Overview Affected versions of this package are vulnerable to Session Fixation through the CookieJar middleware accepting and storing a response cookie's Domain attribute without verifying that it matches the host that supplied the cookie or rejecting public suffixes. An attacker can cause cookies...

EUVD-2026-79179

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server...

CVE-2026-86782

The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts...

CVE-2026-88017 rclone: FTP cross-session auth-proxy backend confusion

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass mapstringstring instead of binding the...

EUVD-2026-72861

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoint that allows authenticated users to modify other users' OAuth token records. Attackers can supply arbitrary row IDs to overwrite another...

CVE-2026-86490

In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint...

CVE-2026-86490

JetBrains YouTrack versions before 2026.2.18634 are affected by improper permission checks in the app import endpoint , allowing an authenticated attacker to overwrite bundled applications. The vulnerability yields a CVSS 3.1 score of 6.5 (Medium) with high integrity impact , exploitable over the...

CVE-2026-86490

In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint...

CVE-2026-86490: Incorrect Authorization

In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint...

CVE-2026-19274

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR na...

CVE-2026-82280 Quivr Prompt Endpoints Missing Ownership Validation

Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt by identifier. Attackers with read-only access to shared brains can read exposed prompt identifiers and overwrite system prompts affecting all brain users...

VulnCheck KEV: CVE-2026-16759

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutorcoursefilterajax AJAX action. This is due to missing authorization on the handler...

CVE-2026-54687 n8n-nodes-sqlite3: Path traversal via user-controlled database file path (db_path parameter)

n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the dbpath database file path as a node parameter that permits data expressions from upstream workflow input. A workflow author who maps untrusted input to dbpa...