13 matches found
SMB_CVE-2025-24071
CVE-2025-24071 PoC SMB + TAR Extraction Method This is a PoC for exploiting CVE-2025-24071 , a vulnerability in Windows that allows NTLM hash leakage via .library-ms files. This version diverges slightly from others by using a .tar archive instead of a .zip, which improves compatibility in SMB-on...
lsassy
lsassy Python tool to remotely extract credentials on a set of hosts. This blog post explains how it works. This tool uses impacket project to remotely read necessary bytes in lsass dump and pypykatz to extract credentials. Chapters| Description ---|--- Warning| Before using this tool, read this...
go-secdump
go-secdump Description Package go-secdump is a tool built to remotely extract hashes from the SAM registry hive as well as LSA secrets and cached hashes from the SECURITY hive without any remote agent and without touching disk. The tool is built on top of the library go-smb and use it to...
CVE-2026-45433
This vulnerability exists in GX Earth 2022 ONT models due to the presence of hardcoded RSA private key within the device firmware. A remote attacker could exploit this vulnerability by extracting the cryptographic private key from the firmware, which could lead to decryption of HTTPS traffic and...
EUVD-2026-34251
This vulnerability exists in GX Earth 2022 ONT models due to the presence of hardcoded RSA private key within the device firmware. A remote attacker could exploit this vulnerability by extracting the cryptographic private key from the firmware, which could lead to decryption of HTTPS traffic and...
CVE-2026-32885: Improper Limitation of a Pathname to a Restricted Directory
DDEV is an open-source tool for running local web development environments for PHP and Node.js. Versions prior to 1.25.2 have unsanitized extraction in both Untar and Unzip functions in pkg/archive/archive.go. Downloads and extracts archives from remote sources without path validation. Version...
PT-2023-21549 · Sage · Sage 200 Spain
Name of the Vulnerable Software and Affected Versions: Sage 200 Spain version 2023.38.001 Description: The issue is related to plaintext credential usage, which could allow a remote attacker to extract SQL database credentials from the DLL application. This could be linked to known techniques to...
CVE-2023-30620: Improper Limitation of a Pathname to a Restricted Directory
mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed using tarfile.extractall from a remotely retrieved tarball. Which may lead to the writing of the extracted files to an unintended location. Sometimes, the...
SQL Injection in phili67/ecclesiacrm
✍️ Description SQL Injection SQLi found in search section for http://YOURIP/ecclesiacrm/v2/people/list/person. A SQL Injection allows an attacker to run SQL command remotely and can extract information such as password, usernames and other sensitive data. This SQLi is a blind SQLi and doesn't...
Lsassy - Extract Credentials From Lsass Remotely
Python library to remotely extract credentials. This blog post explains how it works. You can check the wiki This library uses impacket project to remotely read necessary bytes in lsass dump and pypykatz to extract credentials. Requirements Python = 3.6 pypykatz = 0.3.0 impacket Installation From...
Authentication flaw
In all versions of ABB Power Generation Information Manager PGIM and Plant Connect, the affected product is vulnerable to authentication bypass, which may allow an attacker to remotely bypass authentication and extract credentials from the affected device...
Spectre attack variant can be remotely mounted to extract sensitive data
By ghostadmin What we know so far about Spectre attacks is that it relies upon execution of malicious code. The code is executed on computers having speculative-execution design flaws in processor chip; once a device is compromised, it becomes possible to obtain sensitive data such as passwords,...