polkadots

polkadots CVE-2021-3560 استغلال تصعيد الامتيازات المحلي يقوم هذا الاستغلال بإنشاء مستخدم جديد بصلاحيات مرتفعة، يمكنك بواسطته التصعيد إلى صلاحيات الجذر root. التوزيعات المتأثرة: RHEL 8 Fedora 21 Debian testing Bullseye Ubuntu 20.04 الاستخدام root@kitploit: ./polkadots -a Account -n Account name -h...

phishlulz

PhishLulz PhishLulz is a Ruby toolset aimed at automating Phishing activities. When you start a phishing campaign, a dedicated Amazon EC2 Debian 7 instance is spawned. The VM comes with various open source tools that have been glued together. The two main components are: PhishingFrenzy...

CVE-2024-22274

CVE-2024-22274: Esecuzione remota di codice autenticata in VMware vCenter Server Il server vCenter contiene una vulnerabilità di esecuzione remota di codice autenticata. Un attore malintenzionato con privilegi amministrativi sulla shell dell'appliance vCenter potrebbe sfruttare questo problema pe...

NetMRI-2014-3418

NetMRI-CVE-2014-3418 - Metasploit 模块 InfoBlox Network Automation OS 命令注入 Metasploit 模块 产品：Network Automation root@kitploit: NetMRI Switch Port Manager Automation Change Manager Security Device Controller 厂商： root@kitploit: InfoBlox 受影响版本： root@kitploit: 6.4.X.X-6.8.4.X 测试版本： root@kitploit: 6.8.2....

CVE-2021-4034

CVE-2021-4034 CVE-2021-4034 Add Root User - Pkexec Local Privilege Escalation Basato su CVE-2021-4034 è stato potenziato: l'esecuzione dell'Exploit aggiungerà per impostazione predefinita il nome utente rooter, la password Hello@World, e l'utente rooter avrà privilegi sudo. Fare riferimento a...

dirtyCow

Dirtycow, também conhecido como CVE-2016-5195, é uma vulnerabilidade muito popular do passado. Primeiro, escolha a versão Linux adequada para essa vulnerabilidade. Em seguida, instale ou execute-a no VBOX ou VMWare. Depois de instalá-la, siga estas instruções. 1. Crie um usuário sem ter acesso...

CVE-2026-0770

CVE-2026-0770: Langflow execglobals 인증되지 않은 원격 코드 실행 PoC CVE-2026-0770 는 Langflow에 영향을 미치는 인증되지 않은 원격 코드 실행RCE 취약점입니다. 이 결함은 /validate 엔드포인트에 제공된 execglobals 매개변수 처리 중 부적절한 입력 검증으로 인해 발생합니다. 이를 악용하여 공격자는 검증 루틴 중 신뢰할 수 없는 전역 환경을 전달할 수 있으며, root 사용자 컨텍스트에서 원격 코드 실행을 달성합니다. ! 면책 조항 경고: 이 도구는 승인된 보안...

VMware VRealize Network Insight - Remote Code Execution

VMWare Aria Operations for Networks vRealize Network Insight is vulnerable to command injection when accepting user input through the Apache Thrift RPC interface. This vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on the underlying operating system as the ro...

sadcloud

Sadcloud sadcloud is a tool for spinning up insecure AWS infrastructure with Terraform. It supports approx. 84 misconfigurations across 22 AWS Services. The inital set of misconfigurations were drawn from ScoutSuite, NCCGroup's Multi-cloud auditing tool. sadcloud was created to easily allow...

CVE-2026-75855

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names...

New API: User List API Leaks Root User Access Token Leading to Privilege Escalation

Vulnerability Information - Product: new-api - Affected versions: versions before v1.0.0-rc.7 that serialize User.AccessToken as accesstoken; the issue was confirmed in v0.12.14 - Patched version: v1.0.0-rc.7 - Fixed commit: 0936e2504655a5cbf7bc3c388f6d3e2bb24916d3 - Type: Information Disclosure ...

GHSA-6X2C-PHFF-WX57 New API: User List API Leaks Root User Access Token Leading to Privilege Escalation

Vulnerability Information - Product: new-api - Affected versions: versions before v1.0.0-rc.7 that serialize User.AccessToken as accesstoken; the issue was confirmed in v0.12.14 - Patched version: v1.0.0-rc.7 - Fixed commit: 0936e2504655a5cbf7bc3c388f6d3e2bb24916d3 - Type: Information Disclosure ...

CVE-2026-64859

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as accesstoken because User model objects are serialized after queries use...

CVE-2026-64859 New API: User List API Leaks Root User Access Token Leading to Privilege Escalation

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as accesstoken because User model objects are serialized after queries use...

CVE-2026-64859

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as accesstoken because User model objects are serialized after queries use...

CVE-2026-64859

In new-api before v1.0.0-rc.7, the User model's AccessToken field was serialized as "access_token" in JSON responses to admin-only endpoints (GET /api/user/ and user lookup). An authenticated admin could retrieve the root user's bearer token and impersonate root, bypassing role boundaries to acce...

GO-2023-1683 vulnerabilities

Vulnerabilities for packages: podman, ctop...

CVE-2026-18713 IBM i is Affected By Multiple Vulnerabilities in Navigator for i

IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute commands...

CVE-2026-18683 IBM i is Affected By privilege escalation in Navigator for i

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute commands...

PT-2026-71169

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute commands...