cve-2024-21980-poc

Vulnérabilité du firmware SEV Ce dépôt contient un exploit pour une vulnérabilité dans le firmware SEV. L'exploit permet de déchiffrer la mémoire arbitraire d'un invité SEV-SNP après qu'il a été désaffecté. Testé sur la version 1.55.16 la plus récente au moment de la rédaction. Cause racine Le...

CVE-2021-3156

CVE-2021-3156 PoC 소개 이것은 sudo의 CVE-2021-3156 취약점Qualys가 Baron Samedit이라고 명명에 대한 익스플로잇입니다. 사용법 빌드: root@kitploit: $ make 타겟 목록: root@kitploit: $ ./sudo-hax-me-a-sandwich 실행: root@kitploit: $ ./sudo-hax-me-a-sandwich 수동 모드: root@kitploit: $ ./sudo-hax-me-a-sandwich 브루트 포스 타겟 검출 실험적 GNU parallel이 설치...

PoC-CVE-2000-0649

PoC-CVE-2000-0649 Un petit outil pour créer un PoC pour CVE-2000-0649. Utilisation Ce script vérifie si le serveur est vulnérable à CVE-2000-0649. N'oubliez pas d'expérimenter avec HTTP, HTTPS et différents chemins. Selon mon expérience, la divulgation se produit principalement lors de la connexi...

CVE-2013-3900-Remediation-Script

root@kitploit: CVE-2013-3900 수정 스크립트 32비트 및 64비트 구성에 대한 레지스트리 경로 정의 $regPaths = @ "HKLM:\Software\Microsoft\Cryptography\Wintrust\Config", "HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" 레지스트리 키를 추가하거나 업데이트하는 함수 function Set-EnableCertPaddingCheck param string$path if !Test-Pa...

gimp: GIMP: Remote code execution via PSD file parsing integer overflow

A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability within the readchanneldata function during PSD Photoshop Document file parsing by enticing a user to open a specially crafted PSD file. This could lead to arbitrary code execution in the context of the...

gimp: gimp: Stack buffer overflow in pnmscanner_gettoken()

A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscannergettoken function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption,...

tutor-lms-methodmap-poc

Tutor LMS ≤ 4.0.5 — Unauthenticated PHP Function Execution via...

kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

A flaw was found in the Linux kernel's IPv4 networking component. The ipv4sysctlexitnet function prematurely frees the net-ipv4.sysctllocalreservedports memory. This can lead to a use-after-free vulnerability, where other threads might attempt to access deallocated memory. Such an issue can resul...

CVE-2026-18024

A flaw was found in PostgreSQL. A buffer over-read vulnerability in the ascii SQL function allows a user to disclose up to 3 bytes of memory after the end of a specific allocation by providing a specially crafted text value. This could lead to limited information disclosure. Mitigation To mitigat...

qs: qs: Denial of Service via improper validation in stringify function

A flaw was found in qs. The qs.stringify function, responsible for serializing objects, does not properly validate the isBuffer property of an object's constructor before attempting to invoke it. An unauthenticated attacker can provide specially crafted input that, when processed and then...

kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

A flaw was found in the Linux kernel's IPv4 networking component. The ipv4sysctlexitnet function prematurely frees the net-ipv4.sysctllocalreservedports memory. This can lead to a use-after-free vulnerability, where other threads might attempt to access deallocated memory. Such an issue can resul...

CVE-2025-7963

The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcodeeasywaveformplayer function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

-

Nanobot — Modular AI Agent Implementation Implement an open-s...

eldap: eldap: Denial of Service via long LDAP referral URL port

A flaw was found in eldap, a component of Erlang/OTP. A malicious or compromised Lightweight Directory Access Protocol LDAP server could exploit this vulnerability by returning a referral Uniform Resource Locator URL with an excessively long port number. This unbounded port component is then...

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function

A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand function, which can lead to excessive memory consumption. This can cause a denial of service DoS by crashing the application due to an out-of-memory error...

Important: Red Hat Security Advisory: nodejs:22 security update

An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

A flaw was found in the brace-expansion library. The expand function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is...

jsPDF-Object-Injection

CVE-2026-25755: Обход песочницы jsPDF через внедрение объектов Обзор Критическая уязвимость внедрения PDF-объектов CVE-2026-25755 была обнаружена в jsPDF — широко используемой JavaScript-библиотеке для генерации PDF-документов в клиентских приложениях. Уязвимость существует в функции addJS,...

CVE-2025-7963 Easy Waveform Player <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_easywaveformplayer Function

The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcodeeasywaveformplayer function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-7963 Easy Waveform Player <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_easywaveformplayer Function

The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcodeeasywaveformplayer function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...