msfrpc

NOTE: This tool is no longer under active maintenance. ===================== Metasploit MSGRPC Modules Ryan Linn [email protected] http://www.trustwave.com Modules for communicating with Metasploit MSGRPC Introduction This repository contains two modules for communicating with Metasploit's...

perl_spreadsheet_excel_rce_poc

Vulnerabilidad de seguridad en ParseExcel TL;DR: RCE a partir de la lógica en el análisis de cadenas de formato. Explicación breve sobre el exploit La causa raíz de la explotación proviene de llamar a eval sobre una entrada de usuario no validada en Utility.pm...

[SECURITY] Fedora 44 Update: perl-Data-Entropy-0.010-1.fc44

This module maintains a concept of a current selection of entropy source. Algorithms that require entropy, such as those in Data::Entropy::Algorithms, can use the source nominated by this module, avoiding the need for entropy source objects to be explicitly passed around. This is convenient becau...

[SECURITY] Fedora 44 Update: perl-Protocol-HTTP2-1.14-1.fc44

Protocol::HTTP2 is Perl HTTP/2 protocol implementation RFC 7540 with stateful decoders/encoders of HTTP/2 frames. You may use this module to implement your own HTTP/2 client/server/intermediate on top of your favorite event loop over plain or TLS socket...

[SECURITY] Fedora 45 Update: perl-Data-Entropy-0.010-1.fc45

This module maintains a concept of a current selection of entropy source. Algorithms that require entropy, such as those in Data::Entropy::Algorithms, can use the source nominated by this module, avoiding the need for entropy source objects to be explicitly passed around. This is convenient becau...

Astra Linux – Vulnerability in libmodule-scandeps-perl

Qualys discovered that if unsanitized input was used with the Modules::ScanDeps library, before version 1.36, a local attacker could potentially execute arbitrary shell commands by opening a “pesky pipe” e.g., passing “commands|” as a filename or by passing arbitrary strings to the eval function...

Astra Linux - Vulnerability in libdata-validate-ip-perl

The Data::Validate::IP module for Perl, up to version 0.29, does not properly handle extraneous zero characters at the beginning of an IP address string, which in some situations allows attackers to bypass access control based on IP addresses...

[SECURITY] Fedora 43 Update: perl-Net-DNS-1.56-1.fc43

Net::DNS is a collection of Perl modules that act as a Domain Name System DNS resolver. It allows the programmer to perform DNS queries that are beyond the capabilities of gethostbyname and gethostbyaddr. The programmer should be somewhat familiar with the format of a DNS packet and its various...

[SECURITY] Fedora 44 Update: perl-Net-DNS-1.56-1.fc44

Net::DNS is a collection of Perl modules that act as a Domain Name System DNS resolver. It allows the programmer to perform DNS queries that are beyond the capabilities of gethostbyname and gethostbyaddr. The programmer should be somewhat familiar with the format of a DNS packet and its various...

SUSE CVE-2026-16028

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

CVE-2026-85484

HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping. The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets render a group label unescaped, Select into a label attribute and the other three into element...

CVE-2026-85485

The HTML::FormHandler Perl module in versions before 0.410002 is vulnerable to Cross-Site Scripting (XSS) . The root cause is the failure to properly escape certain error messages when rendered into HTML. Specifically, the Table form layout and the Bootstrap 2 and 3 wrappers splice error strings ...

CVE-2026-81928

A flaw was found in Net::DNS versions before 1.57 for Perl. An attacker can cause a denial of service DoS by sending a specially crafted DNS message with a misplaced Transaction Signature TSIG record. When a system using Net::DNS, such as a forwarder or proxy, attempts to re-encode this message, ...

Linux Distros Unpatched Vulnerability : CVE-2026-85484

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping. The Select, RadioGroup,...

Linux Distros Unpatched Vulnerability : CVE-2026-85630

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the processattrs method. Any application with field...

EulerOS 2.0 SP12 : perl-HTML-Parser (EulerOS-SA-2026-3368)

According to the versions of the perl-HTML-Parser package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTML::Entities versions before 3.84 for Perl read freed heap memory in decodeentities. The XS routine backing...

CVE-2026-86287

Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table. The result is that the lookup will silently succe...

CVE-2026-16028

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

CVE-2026-16028

The Protocol::HTTP2 Perl module (versions before 1.14 ) is vulnerable to memory exhaustion leading to a denial of service . The root cause is that the stream_state function fails to remove closed streams from the connection stream table, allowing a peer to indefinitely accumulate residual entries...

EUVD-2026-72526

Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table. The result is that the lookup will silently succe...