solr_rce

Apache Solr RCE via Velocity template python usage: python solrrce.py http://x.x.x.x:8983 command getshell encode payload http://www.jackson-t.ca/runtime-exec-payloads.html whoami bash -c echo,d2hvYW1p|base64,-d|bash,-i 0x01 Introduction to Solr Solr is an open-source enterprise search platform...

0day-security-software-vulnerability-analysis-technology

0day-security-software-vulnerability-analysis-technology Notas de uso del paquete de materiales complementarios de «Seguridad 0day: Tecnología de análisis de vulnerabilidades de software segunda edición» Los materiales incluidos en el paquete se proporcionan únicamente con fines de aprendizaje...

BIT-TOMCAT-2026-68763 Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.0 through 10.1.57, from 9.0.39 through 9.0.120. The following versions were EOL at...

BIT-TOMCAT-2026-41284 Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.21, from 10.1.0 through 10.1.54, from 9.0.0 through 9.0.117. Older, unsupported versions may also be affected. Users are recommended to upgrade to versio...

cve-2026-5950-bind9-resolver-dos

CVE-2026-5950 - DoS del Resolvedor de BIND 9 Notas de investigación y guía defensiva para CVE-2026-5950, una vulnerabilidad de bucle de reenvío ilimitado en la máquina de estados del resolvedor de BIND 9. Descripción general CVE-2026-5950 afecta a resolvedores recursivos de BIND 9. Bajo condicion...

CVE-2026-89060

A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference...

cve

CVE Enunciado del problema: Stackoverflow Estoy intentando compilar mi proyecto en Docker, así que estoy usando Docker Desktop para compilar mi proyecto; cuando compilo la imagen, obtengo esto como una de mis vulnerabilidades root@kitploit: CVE-2024-26308 CWE-770 7.5 H Allocation of Resources...

hacker-roadmap

本仓库概述了学习渗透测试所需的内容，并汇集了用于实践道德黑客的黑客工具、资源和参考资料。大多数工具都是UNIX兼容的、免费且开源。 状态 该项目已终止并归档 。内容可能已过时。 开始之前 如果你是信息安全新手，请忘记你所知道的一切关于黑客的知识。 在阅读渗透测试及其工作原理之前，不要开始使用工具（参见附加资源章节）。 如果你没有审计过工具的代码，请不要下载或使用。 不要使用这些工具做蠢事，比如未经同意调查/黑客朋友，或者更糟，你的招聘人员。 阅读书籍、手册、文章，保持好奇心，不要仅仅成为一个脚本小子。 我希望你不要将这些工具用于非法目的，但如果你真的这样做了，我当然希望你知道自己在做什么...

poc-graphql

目录 目录 关于GraphQL的研究 目标 实验室 在Docker上部署 安全弱点 授权 问题 建议 注入 问题 建议 资源耗尽 问题 建议 私有数据暴露 问题 建议 意外错误时技术信息泄露 问题 建议 不安全的直接对象引用 问题 API暴露给错误的客户端范围 问题 订阅WebSocket端点默认启用 跨源资源共享默认启用 建议 发现查询 使用的参考资料 GraphQL 实验室 关于GraphQL的研究 目标 1. 研究什么是GraphQL。 2. 从应用安全角度分析GraphQL的使用（攻击与防御）。 3. 识别可能被利用的潜在弱点。 实验室...

ApkAnalyser

版权所有 C 2012 索尼移动通信公司 本文件是 ApkAnalyser 的一部分。 根据 Apache 许可证 2.0 版（以下简称“许可证”）授权； 除非遵守许可证，否则您不得使用此文件。 您可以在以下网址获取许可证副本： root@kitploit: http://www.apache.org/licenses/LICENSE-2.0 除非适用法律要求或书面同意，否则根据许可证分发的软件均按“原样”分发， 不附带任何明示或暗示的担保或条件。 请参阅许可证以了解管理权限和限制的特定语言。...

aws-recon

AWS Recon 一款用 Ruby 编写的多线程 AWS 安全清单收集工具。 该工具旨在高效收集大量 AWS 资源属性与元数据。它目标是收集与 AWS 环境安全配置及状态相关的几乎所有内容。 现有工具（例如 AWS Config）虽然能执行某些资源收集，但在覆盖范围和特异性上不足以准确衡量安全状态（例如详细的资源属性数据、完整解析的策略文档以及嵌套的资源关系）。 AWS Recon 通过利用自动重试（无论是网络可靠性问题还是 API 限流）、自动分页处理大型响应（每次 API 调用超过 100 个资源）以及多线程并行请求来加速收集，从而处理大型账户的收集工作。 项目目标...

PT-2026-90064

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames mt7996/mt7992 hand the firmware a HW MAC-TXP for AddBA req action frames MT TXD7 MAC TXD, set in mt7996 mac write txwi 80211, but are otherwise FW-TXP devices. On t...

PT-2026-90120

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Release the Rx HopID that was handed out on mismatch tb xdomain alloc in hopid passes the wanted HopID to ida alloc range as the lower bound, so a taken id is not an error there: the allocator returns the next...

PT-2026-90145

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails amd pmc probe registers the LPS0 s2idle handler with acpi register lps0 dev and creates the driver's debugfs directory before calling amd stb s2d init, which is...

PT-2026-90396

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsd file leak on inter-server COPY setup failure When nfsd4 setup inter ssc fails, nfsd4 copy returns nfserr offload denied directly, bypassing the out: label where release copy files would drop the nf dst reference...

PT-2026-90070

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: pci: fix resource leak on failed NAPI setup rtw pci probe allocates PCI resources through rtw pci setup resource before it sets up NAPI. If rtw pci napi init fails, the error path jumps straight to err pci declaim an...

PT-2026-90247

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject connection when transport allocation fails handle connect req returns without action when svc rdma create xprt fails to allocate the new transport. The CM core returns 0 for CONNECT REQUEST events, so it does not...

PT-2026-90288

In the Linux kernel, the following vulnerability has been resolved: cpufreq: apple-soc: Fix OPP table cleanup apple soc cpufreq init adds OPP tables from firmware, but some failure paths do not remove them. The driver also uses dev pm opp remove all dynamic, which is not the right cleanup helper...

PT-2026-90060

In the Linux kernel, the following vulnerability has been resolved: tpm: tpm i2c nuvoton: disable IRQ on wait timeout i2c nuvoton wait for stat enables the IRQ before waiting for the interrupt handler to report a status change. If the wait times out, or is interrupted before the handler runs, the...

PT-2026-90361

In the Linux kernel, the following vulnerability has been resolved: btrfs: drop recovered reloc root refs on recovery failure During relocation recovery, each fs root gets a reference to its relocation root. If loading or adding a later root fails, or if the first transaction commit fails, btrfs...