CVE-2025-54322-exploit

CVE-2025-54322 : Exploit RCE pré-authentification XSpeeder SXZOS Un exploit Proof-of-Concept PoC professionnel pour CVE-2025-54322 , une vulnérabilité critique d'exécution de code à distance sans authentification dans le firmware XSpeeder SXZOS. Cette vulnérabilité a été découverte et divulguée p...

Cisco ISE < 3.4P2 - Unauthenticated Arbitrary File Upload

Cisco ISE and Cisco ISE-PIC contain an unrestricted file upload vulnerability caused by lack of file validation in an internal API, letting unauthenticated remote attackers upload and execute files as root, exploit requires crafted file upload. id: CVE-2025-20282 info: name: Cisco ISE 3.4P2 -...

RootQuest-CTF-Box-Multi-Stage-Exploitation-VM

RootQuest CTF Box — Многоэтапная эксплуатационная ВМ 💀 Kalaichelvan Thieveshkar CB013248 · Стаффордширский университет · COMP50003 - Cyber Security II Обзор RootQuest — это специально созданная виртуальная машина для CTF, содержащая 10-этапную последовательную атаку, охватывающую 5 доменов...

CVE-2020-5902

🚨 CVE-2020-5902 — F5 BIG-IP TMUI RCE CVE-2020-5902 è una vulnerabilità critica di Esecuzione Remota di Codice RCE non autenticata nell'Interfaccia Utente di Gestione del Traffico TMUI / utility di configurazione di F5 BIG-IP. 📌 Panoramica Divulgata da F5 il 30 giugno 2020 pubblicata su NVD il 1°...

CVE-2025-8110

CVE-2025-8110 — Gogs = 0.13.3 सिमलिंक ट्रैवर्सल के माध्यम से मनमानी फ़ाइल लेखन अवलोकन Gogs = 0.13.3 PutContents API /api/v1/repos/:owner/:repo/contents/:path के माध्यम से मनमानी फ़ाइल लेखन के लिए असुरक्षित है। API निर्देशिका-ट्रैवर्सल अनुक्रमों ../ के लिए फ़ाइल पथों को मान्य करता है, लेकिन लिखने ...

Kioptrix-Level1-Vulnerability-Analysis

Kioptrix Level 1: पूर्ण-स्पेक्ट्रम भेद्यता ऑडिट और एक्सप्लॉइटेशन 🏛️ व्यावसायिक उद्देश्य उद्देश्य Kioptrix Level 1 वातावरण पर एक संरचित पेनिट्रेशन परीक्षण करना था, ताकि पूर्ण 'root' अभिगम प्राप्त किया जा सके और रेड तथा ब्लू टीम संचालन दोनों के लिए उपयुक्त तकनीकी उपचार रणनीतियों का दस्तावेज़ीकरण किय...

blackbox-pentesting-infsecos

Test di penetrazione Black-Box — SecOS:1 VulnHub Panoramica Test di penetrazione black-box completo contro SecOS:1 , una macchina CTF volutamente vulnerabile di VulnHub. Obiettivo: simulare un attaccante reale senza alcuna conoscenza preliminare e ottenere una compromissione a livello root, come...

CVE-2026-69108

A vulnerability has been identified in Siemens License Server SLS All versions V5.1. The affected application is vulnerable to a local privilege escalation due to an insecure sudoers policy. This could allow an attacker to execute arbitrary commands and plant malicious files as root, leading to...

OESA-2026-3031 cifs-utils security update

The in-kernel CIFS filesystem is generally the preferred method for mounting SMB/CIFS shares on Linux. Security Fixes: A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in...

ALSA-2026:26533 Important: dracut security update

The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition...

DEBIAN-CVE-2026-48693

FastNetMon Community Edition through 1.2.9 is vulnerable to a local symlink attack via predictable file paths in /tmp. The statistics file path defaults to '/tmp/fastnetmon.dat' src/fastnetmon.cpp line 159. The printscreencontentsintofile function src/fastnetmonlogic.cpp line 2186 opens this path...

Fedora 43 : PackageKit (2026-7463cd3c32)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7463cd3c32 advisory. Backport fix for race condition leading to root compromise GHSA-f55j-vvr9-69xv Tenable has extracted the preceding description block directly from the Fedora...

Fedora 42 : PackageKit (2026-41926fe792)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-41926fe792 advisory. Backport fix for race condition leading to root compromise GHSA-f55j-vvr9-69xv Tenable has extracted the preceding description block directly from the Fedora...

nix: coroutine stack-to-heap overflow via unbounded recursion in NAR directory parser

A flaw was found in Nix. Unbounded recursion in the NAR Nix Archive parser could lead to a stack-to-heap overflow when the parser is run on a coroutine stack. The stack is allocated without a guard page, which means that a stack overflow could overwrite memory on the heap and could allow arbitrar...

Fedora 44 : PackageKit (2026-6c121b3d4c)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6c121b3d4c advisory. Backport fix for race condition leading to root compromise GHSA-f55j-vvr9-69xv Tenable has extracted the preceding description block directly from the Fedora...

CVE-2026-21916

A UNIX Symbolic Link Symlink Following vulnerability in the CLI of Juniper Networks Junos OS allows a local, authenticated attacker with low privileges to escalate their privileges to root which will lead to a complete compromise of the system. When after a user has performed a specific 'file lin...

CVE-2025-69426

The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 GA contain hardcoded credentials for an operating system user account within an initialization script. The SSH service is network-accessible without IP-based restrictions. Although the configuration disables SCP and pseudo-TTY...

CVE-2025-41717 Config-Upload Code Injection

An unauthenticated remote attacker can trick a high privileged user into uploading a malicious payload via the config-upload endpoint, leading to code injection as root. This results in a total loss of confidentiality, availability and integrity due to improper control of code generation 'Code...

CVE-2025-69426

The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 GA contain hardcoded credentials for an operating system user account within an initialization script. The SSH service is network-accessible without IP-based restrictions. Although the configuration disables SCP and pseudo-TTY...

CVE-2025-69426

The CVE-2025-69426 issue affects Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0. An initialization script contains hardcoded OS user credentials, enabling authentication even though SCP and pseudo-TTY are disabled. The SSH service is network-accessible without IP-based restriction...