nginx-rift-private-lab

NGINX Rift 针对 CVE-2026-42945 的 RCE 概念验证，这是 NGINX 的 ngxhttprewritemodule 中一个严重堆缓冲区溢出漏洞，于 2008 年引入。该漏洞使得攻击者能够对使用了 rewrite 和 set 指令的服务器进行未经认证的远程代码执行。 本分支扩展了原始 PoC，引入了一条绕过 ASLR 的攻击链，它将 NGINX 溢出漏洞与常见的同主机 LFI/任意文件读取原语相结合。文件读取原语用于恢复 nginx 工作进程映射、libc 以及实时的 /proc//mem，然后远程推导出 system 地址和可用的堆目标。...

CVE-2026-57120

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, executecode sandbox mode permits runtime assembly of blocklisted dunder names and allows str.format or str.formatmap to resolve dotted fields through C-level attribute access that bypasses safegetattr. This exposes class,...

GHSA-QG8R-F7X3-25F7 imageproc: Out-of-bounds read via NaN coordinates in bilinear/bicubic sampling

A bounds check was performed in floating points before a cast to the index passed to an unchecked access function. This checked considered NaN cases improperly, causing them to succeed the check instead of failing it. The floating point coordinate is under caller control by passing a selected...

CVE-2019-15662

An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120444 in KfeCo10X64.sys fails to validate an offset passed as a parameter during a memory operation, leading to an arbitrary read primitive that can be used as part of a chain to escalate privileges...

VulnCheck KEV: CVE-2025-2776

SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives...

Exploit for Exposed IOCTL with Insufficient Access Control in Dell Dbutil

CVE-2021-21551 Exploit to SYSTEM for CVE-2021-21551 SpoolPrin...

CVE-2019-15662

An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120444 in KfeCo10X64.sys fails to validate an offset passed as a parameter during a memory operation, leading to an arbitrary read primitive that can be used as part of a chain to escalate privileges...

Buffer overflow

An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120444 in KfeCo10X64.sys fails to validate an offset passed as a parameter during a memory operation, leading to an arbitrary read primitive that can be used as part of a chain to escalate privileges...

CVE-2019-19197

IOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an attacker to achieve privilege escalation, denial-of-service, and code execution via usermode because 0x9C402401 using METHODNEITHER results in a read primitive...

CVE-2019-19197

IOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an attacker to achieve privilege escalation, denial-of-service, and code execution via usermode because 0x9C402401 using METHODNEITHER results in a read primitive...

CVE-2019-19197

CVE-2019-19197 relates to IOCTL handling in the kyrld.sys driver of Kyrol Internet Security 9.0.6.9. The vulnerability arises when 0x9C402401 is issued via METHOD_NEITHER, leading to a read primitive that enables local privilege escalation, denial of service, and potential code execution in userm...