CVE-2020-8554

Crear clúster de Kubernetes kind create cluster --config ./kind.yaml El clúster debe tener certmanager: https://cert-manager.io/docs/installation/kubernetes/ Probar la vulnerabilidad kubectl apply -f - 'EOF' apiVersion: v1 kind: Namespace metadata: name: kubeproxy-mitm --- apiVersion: apps/v1 kin...

mikrotrick-poc

MikroTrick lab PoC — CVE-2026-67276 RouterOS SSH public-key auth bypass Lab use only. Run exclusively against RouterOS instances you own. Attacking devices you do not own is a crime CFAA, Polish art. 267, equivalents. Background CERT PL 2026-09-05 disclosed six RouterOS vulnerabilities, actively...

Rogue-Framework

Rogue Framework "Make it rain. " Rogue Amendiares The best intel-broker in night city Rogue Framework is a desktop workbench for AFL++, cross-architecture QEMU fuzzing, harness development, lightweight Ghidra headless analysis, custom mutators, and patch comparison. It is intentionally an auditab...

Mirth-Connect-CVE-2023-43208

CVE-2023-43208: Unauthenticated Remote Code Execution RCE in NextGen Mirth Connect This exploit leverages a critical deserialization vulnerability within Mirth Connect's XStream engine. It stems from an incomplete patch for CVE-2023-37679, enabling unauthenticated arbitrary code execution across...

grandstream-cve-2026-2329-analysis

Patch and Variant Analysis of CVE-2026-2329 in Grandstream GXP1600 Firmware Defensive static-analysis project comparing Grandstream GXP1600 firmware 1.0.7.79 vulnerable and 1.0.7.81 patched to understand how the vendor remediated the request-parsing flaw associated with CVE-2026-2329. Why this...

CVE-2021-3156-Patch

CVE-2021-3156-Patch Script de parche para el desbordamiento de montón heap overflow CVE-2021-3156...

CVE-2025-70341

CVE-2025-70341: Permisos inseguros + Ejecución de código arbitrario en App-Auto-Patch Resumen App-Auto-Patch v3.4.2 crea su directorio de trabajo con permisos de escritura mundial chmod 777, lo que permite una condición de carrera TOCTOU local. Un atacante local no privilegiado puede explotar est...

advisories

Avisos de seguridad Avisos de seguridad de Kelly Kaoudis @kaoudis y amigos. En general, publicaré aquí ya sea después de que el proveedor haya aplicado el parche, o después de 90 días desde el descubrimiento de la vulnerabilidad. ¡Feliz lectura! Los avisos están numerados en orden de descubrimien...

CVE-2024-10449-patch

Parche para CVE-2024-10449 https://nvd.nist.gov/vuln/detail/CVE-2024-10449 Pasos: Descarga el archivo loginAction.php parcheado de este repositorio https://raw.githubusercontent.com/g-u-i-d/CVE-2024-10449-patch/refs/heads/main/loginAction.php y reemplaza la versión vulnerable con este. Edita el...

framework_base_CVE-2023-21285_NoPatch

Este repositorio no tiene un README...

CVE-2021-36934

CVE-2021-36934 Fix for the CVE-2021-36934 Script will run and check if your system is affected and then apply the fix...

CVE-2011-2461_Magento_Patch

CVE-2011-2461MagentoPatch By Edmonds Commerce This CVE relates to a CSRF vulnerability in the Adobe Flex .swf files used by Magento. You can find more information regarding the CVE here: Peter O'Callaghan - Magento CSRF vulnerability via Adobe Flex Minded Security - The old is new, again...

CVE-2025-50154

NTLM/SMB Hardening & Threat Hunt Toolkit Author: w01f Version: 1.0 Purpose: Audit, harden, and hunt for insecure NTLM/SMB usage to mitigate risks such as CVE-2025-50154. CVE-2025-50154 Overview Severity: High Type: NTLM Credential Leak + Patch Bypass Zero-Click Affected: Windows 10/11, Windows...

CVE-2021-42013

CVE-2021-42013 Colaborador 석은호@eunho87 CVE-2021-42013 Apache http Server Path Traversal Resumen de la vulnerabilidad Un error en el manejo de la normalización de rutas en Apache HTTP Server 2.4.50 permite leer archivos arbitrarios o ejecutar código remoto sin autenticación. Se originó debido a un...

Cisco ISE < 3.4P2 - Unauthenticated Arbitrary File Upload

Cisco ISE and Cisco ISE-PIC contain an unrestricted file upload vulnerability caused by lack of file validation in an internal API, letting unauthenticated remote attackers upload and execute files as root, exploit requires crafted file upload. id: CVE-2025-20282 info: name: Cisco ISE 3.4P2 -...

Cisco IOS HTTP Configuration - Authentication Bypass

HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL. id: CVE-2001-0537 info: name: Cisco IOS HTTP Configuration - Authentication Bypass author:...

Verint Workforce Optimization 15.2.8.10048 - Cross-Site Scripting

Verint Workforce Optimization 15.2.8.10048 contains a cross-site scripting vulnerability via the control/mynotifications NEWUINAV parameter. id: CVE-2021-36450 info: name: Verint Workforce Optimization 15.2.8.10048 - Cross-Site Scripting author: atomiczsec severity: medium description: Verint...

Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)

Microsoft Exchange Server contains a remote code execution caused by improper input validation in the server component, letting remote attackers execute arbitrary code, exploit requires network access to the server. id: CVE-2021-28480 info: name: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass...

EyesOfNetwork 5.1-5.3 - SQL Injection/Remote Code Execution

EyesOfNetwork 5.1 to 5.3 contains SQL injection and remote code execution vulnerabilities. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. See also CVE-2020-8655,...

Atlassian Jira Confluence - Cross-Site Scripting

Atlassian Jira Confluence before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4, and from version 7.9.0 before version 7.9.2, allows remote attackers to inject arbitrary HTML or JavaScript via a cross-site scripting vulnerability in the error messa...