GHSA-44JG-JGJX-3XG5

creationtimestamp| type| source ---|---|--- 2024-02-22 22:07:58+00:00| published-proof-of-concept| https://t.me/arpsyndicate/4071...

pypqc private key retrieval vulnerability

Impact kyber512, kyber768, and kyber1024 only: An attacker able to submit many decapsulation requests against a single private key, and to gain timing information about the decapsulation, could recover the private key. Proof-of-concept exploit exists for a local attacker...

GHSA-84XV-JFRM-H4GM

creationtimestamp| type| source ---|---|--- 2024-02-22 19:00:30+00:00| published-proof-of-concept| https://t.me/arpsyndicate/4003 2025-03-13 00:43:13+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/7390 2025-05-12 23:29:29+00:00| published-proof-of-concept|...

GHSA-FMG4-X8PW-HJHG Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials

The CORS middleware allows for insecure configurations that could potentially expose the application to multiple CORS-related vulnerabilities. Specifically, it allows setting the Access-Control-Allow-Origin header to a wildcard "" while also having the Access-Control-Allow-Credentials set to true...

Exploit for OS Command Injection in Apache Spark

CVE-2022-33891 - Apache Spark UI Remote Code Execution RCE 🔐...

Exploit for CVE-2024-25600

CVE-2024-25600 Exploit Tool 🚀 Description 📝 This tool 🛠️...

Fedora 38 : pdns-recursor (2024-4e36df9dfd)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-4e36df9dfd advisory. Update to latest upstream. Fixes CVE-2023-50387 and CVE-2023-50868 Tenable has extracted the preceding description block directly from the Fedora...

Proof of storage crypto miners

We explore “proof-of-storage" cryptocurrencies like Chia, the potential for proof-of-storage cryptojacking attacks, and steps defenders can take to detect them...

GHSA-3W4H-R27H-4R2W

creationtimestamp| type| source ---|---|--- 2024-02-21 07:53:10+00:00| published-proof-of-concept| https://t.me/arpsyndicate/3748...

Exploit for CVE-2024-25600

CVE-2024-25600Nuclei-Template Nuclei template and information...

MeshCentral cross-site websocket hijacking (CSWSH) vulnerability

We have identified a cross-site websocket hijacking CSWSH vulnerability within the control.ashx endpoint of MeshCentral. This component is the primary mechanism used within MeshCentral to perform administrative actions on the server. To demonstrate the impact of the vulnerability we developed a...

GHSA-375G-39JQ-VQ7M Potential buffer overflow in CBOR2 decoder

Summary Ever since https://github.com/agronholm/cbor2/pull/204 or specifically https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542 was merged, I can create a reproducible crash when running the snippet under PoC on a current Debian bullseye aarm64 on a Raspberry Pi ...

Debian dla-3736 : libunbound-dev - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3736 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3736-1 [email protected]...

Exploit for CVE-2024-25600

CVE-2024-25600 Exploit Tool 🚀 Description 📝 This tool 🛠️...

CVE-2023-40150

creationtimestamp| type| source ---|---|--- 2024-02-20 20:05:39+00:00| published-proof-of-concept| https://t.me/SEReborn/4535...

CVE-2019-10869

creationtimestamp| type| source ---|---|--- 2024-02-20 04:27:58+00:00| published-proof-of-concept| Telegram/DjIZ6fWMXmlmEqKmpuFtQwgBJRCjkSBgRANI4QVLWKJ-IYk...

SPA-CART CMS 1.9.0.3 Cross Site Scripting

Exploit Title: SPA-CART CMS - Stored XSS Date: 2024-01-03 Exploit Author: Eren Sen Vendor: SPA-Cart Vendor Homepage: https://spa-cart.com/ Software Link: https://demo.spa-cart.com/ Version: 1.9.0.3 CVE-ID: N/A Tested on: Kali Linux / Windows 10 Vulnerabilities Discovered Date : 2024/01/03...

Petrol Pump Management Software 1.0 Shell Upload Vulnerability

Exploit Title: Petrol pump management software - File Upload Remote Code Execution RCE unauthenticated Application: Petrol pump management software Date: 20.02.2024 Bugs: File Upload Remote Code Execution RCE unauthenticated Exploit Author: SoSPiro Vendor Homepage: https://www.sourcecodester.com/...

Savsoft Quiz 6.0 Enterprise Cross Site Scripting

Exploit Title: Savsoft Quiz v6.0 Enterprise - Persistent Cross-Site Scripting Date: 2024-01-03 Exploit Author: Eren Sen Vendor: SAVSOFT QUIZ Vendor Homepage: https://savsoftquiz.com Software Link: https://savsoftquiz.com/web/index.php/online-demo/ Version: 6.0 CVE-ID: N/A Tested on: Kali Linux /...

USN-6642-1 bind9 vulnerabilities

Shoham Danino, Anat Bremler-Barr, Yehuda Afek, and Yuval Shavitt discovered that Bind incorrectly handled parsing large DNS messages. A remote attacker could possibly use this issue to cause Bind to consume resources, leading to a denial of service. CVE-2023-4408 Elias Heftrig, Haya Schulmann,...