EternalBlue-Exploit-Demonstration-MS17-010

EternalBlue Exploit Demonstration MS17-010 Cybersecurity lab demonstrating exploitation of CVE-2017-0144 EternalBlue using Metasploit against a vulnerable Windows 7 system, achieving SYSTEM-level access via Meterpreter. This project also simulates a WannaCry-style ransomware attack SAFE DEMO and...

Windows-Kernel-Exploitation

1. 네임드 파이프를 이용한 Non-Paged Pool 오버플로우 익스플로잇 CVE-2020-17087 및 off-by-one 오버플로우에서 시연된, 네임드 파이프 기반의 풀 오버플로우 익스플로잇 기법 2. Segment Heap VS 할당자 메타데이터 남용 세그먼트 힙 VS 할당자 메타데이터를 남용하여 제한된 쓰기 프리미티브예: 풀 오버플로우를 청크 중첩 할당으로 전환하는 기법 도구 현재 세그먼트 힙의 내부 상태를 검사하기 위한 windbg 스크립트가 포함되어 있습니다...

AnyIO process-pool workers can block indefinitely on undrained stderr

ImpactAnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code th...

PYSEC-2026-4024 AnyIO process-pool workers can block indefinitely on undrained stderr

Impact AnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code...

CVE-2026-24306

Azure Front Door 권한 상승 – CVE-2026-24306 PoC 공인된 레드팀 / 연구 목적으로만 사용하십시오. 작성자는 오용에 대해 책임지지 않습니다. 취약점으로 가능한 것: 임의 라우팅 규칙 주입 백엔드 풀 / 원본 그룹 수정 WAF 정책 연결 / 재정의 잘못 구성된 AFD 인스턴스에서 사용자 지정 도메인 탈취 영향 대상: Azure Front Door Standard 및 Premium 티어2026-01-22 이전 패치 빌드 악용에는 공개 엔드포인트 노출 + 유효한 Azure 리소스 ID 형식만 필요합니다. ...

CVE-2026-23842-Denial-of-Service-via-Database-Connection-Pool-Exhaustion-version-1.2.10

CVE-2026-23842 ≤ 1.2.10 버전의 데이터베이스 연결 풀 고갈로 인한 서비스 거부Denial of Service 📌 개요 이 저장소는 ChatterBot 의 높은 심각도 서비스 거부Denial-of-Service 취약점인 CVE-2026-23842 에 대한 제 발견 및 책임 있는 공개Responsible Disclosure 과정을 문서화합니다. GitHub Advisory: GHSA-v4w8-49pv-mf72 CVE ID: CVE-2026-23842 CWE: CWE-400 통제되지 않은 리소스 소비 심각도: 높음...

CVE-2026-86344

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed...

devalue: `stringify`/`uneval` serialize shared memory

Impact stringify and uneval serialize a typed array by emitting its backing ArrayBuffer, not just the view. In the case of a Node Buffer object, the backing buffer is a process-wide shared pool, meaning unrelated memory can be serialized into a response that is then sent to the client. For a Node...

CVE-2022-22715

블로그 글: https://whereisk0shl.top/post/break-me-out-of-sandbox-in-old-pipe-cve-2022-22715-windows-dirty-pipe 익스플로잇은 LOW INTEGRITY에서 실행되어야 합니다 정리는 완료되지 않았습니다. 익스플로잇은 덮어쓰여진 TOKEN 객체만 수정할 뿐 VS 풀 구조는 수정하지 않습니다. 이 부분은 원본 블로그 글에서 설명되어 있습니다...

PT-2026-104053

Name of the Vulnerable Software and Affected Versions 389-ds-base affected versions not specified Description An unauthenticated remote attacker can cause a denial of service by sending a complete LDAP operation followed by the initial bytes of an incomplete LDAPMessage on the same connection. Th...

Rocky Linux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785925031)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785925031 advisory. - When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clea...

CVE-2026-92947

A flaw was found in vm2. The sandbox environment inadvertently exposes the host system's shared memory buffer pool to sandboxed code. An attacker running untrusted code inside the sandbox can access and modify these shared buffers, resulting in unauthorized information disclosure of host memory o...

Malicious code in mfahelper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6df54a49845aa55e3310261ccc7002fe5aabcdf3924875bf7c1ad3fb4751297 package.json declares its only runtime dependency, node-net-pool, as an https tarball pointing at the main branch of an unrelated GitHub account...

CentOS Linux 6 [TuxCare] Security Update: curl / libcurl / libcurl-devel Multiple Vulnerabilities (CENTOS6:CLSA-2026:1787062885)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1787062885 advisory. - When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the...

CentOS Linux 7 [TuxCare] Security Update: curl / libcurl / libcurl-devel Multiple Vulnerabilities (CENTOS7:CLSA-2026:1786028705)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1786028705 advisory. - When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the...

CentOS Linux 8 [TuxCare] Security Update: haproxy (CENTOS-STREAM8:CLSA-2026:1782825341)

The CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1782825341 advisory. - HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpackdhtinsert within...

CVE-2026-102762

The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet, or one chain of packets, from the network driver's receive pool, and nothing returns it. A peer that can deliver a few dozen such messages exhausts the pool and stops all inbou...

CVE-2026-102760

When NetX Secure is built with NXSECUREKEYCLEAR, every TLS record sent on an active session is wiped after it has been handed to TCP. By then the TCP layer owns the packet chain and may already have released it to the packet pool. The wipe therefore writes zeros into packets that are free or in u...

CVE-2026-102716

An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session header the parser cannot convert. The Session branch returns the raw NetX error code instead of an RTSP status code: c / addons/rtsp/nxrtspserver.c:2754 / status =...

CVE-2026-102716

An unauthenticated client can cause a Denial of Service (DoS) on an RTSP server by draining its packet pool. The vulnerability exists in the Session branch of the parser within nx_rtsp_server.c, where a failure in _nx_utility_string_to_uint returns a raw NetX error code instead of a proper RTSP s...