Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Redhat Enterprise_Linux

PoC exploit for CVE-2020-2732. It is an exploit for the PlayStation 4 on 5.05 firmware. The exploit targets the kernel and allows for arbitrary code execution. The exploit includes autolaunching code for Mira and Vortex's HEN payload. The bug was discovered by qwertyoruiopz. The exploit includes...

pwnshop

pwnshop Notes, cheatsheets, shellcode and exploits. Progress: - Utility - Object/Executable file to shellcode converter script: code - Utility - Assembly and link script : code - Utility - Shellcode testing skeleton generator : code - Exit syscall asm: code - Write syscall "Hello world!": code -...

hw/display/cirrus_vga_rop.h in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors related to copying VGA data via the cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_ functions.

...

CVE-2012-10055

ComSndFTP FTP Server version 1.3.7 Beta contains a format string vulnerability in its handling of the USER command. By sending a specially crafted username containing format specifiers, a remote attacker can overwrite a hardcoded function pointer in memory specifically WSACleanup from Ws232.dll...

MAL-2025-38731 Malicious code in wa-ret-rop (npm)

The package wa-ret-rop was found to contain malicious code...

Malicious code in wa-ret-rop (npm)

The package wa-ret-rop was found to contain malicious code...

CVE-2012-10055 ComSndFTP v1.3.7 Beta USER Format String RCE

ComSndFTP FTP Server version 1.3.7 Beta contains a format string vulnerability in its handling of the USER command. By sending a specially crafted username containing format specifiers, a remote attacker can overwrite a hardcoded function pointer in memory specifically WSACleanup from Ws232.dll...

CVE-2025-51060

An issue was discovered in CPUID cpuz.sys 1.0.5.4. An attacker can use DeviceIoControl with the unvalidated parameters 0x9C402440 and 0x9C402444 as IoControlCodes to perform RDMSR and WRMSR, respectively. Through this process, the attacker can modify MSRLSTAR and hook KiSystemCall64. Afterward,...

Amazon Linux 2 : pam (ALAS-2025-2959)

The version of pam installed on the remote host is prior to 1.1.8-23. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2959 advisory. A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to...

Medium: pam

Issue Overview: A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input stdin. As this occurs, the attacker can train the branch predictor to execute an ROP chain...

Amazon Linux 2023 : pam, pam-devel (ALAS2023-2025-1132)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1132 advisory. A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input stdin. As this...

easy-linux-pwn

This is a set of Linux binary exploitation tasks for beginners on various architectures. The tasks are designed to be solved using a suggested approach, even if there are other easier ways. The tasks assume a dynamically linked libc with a known binary and require the use of ROP Return-Oriented...

Exploit for Out-of-bounds Write in Fortinet Fortiproxy

fgt-cve-2023-27997-exploit FortiGate SSL‑VPN CVE‑2023‑279...

Linux Distros Unpatched Vulnerability : CVE-2022-48994

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix function prototype mismatch in sndseqexpandvarevent With clang's kernel contr...

EulerOS 2.0 SP12 : pam (EulerOS-SA-2025-1194)

According to the versions of the pam package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in pamaccess, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers ...

Exploit for Stack-based Buffer Overflow in Ivanti Connect_Secure

PoC exploit for CVE-2025-0282, a remote unauthenticated stack-ba...

pam: libpam: Libpam vulnerable to read hashed password

A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input stdin. As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This fla...

Exploit for Out-of-bounds Write in Fortinet Fortiproxy

cve-2024-21762-poc CVE-2024-21762 is a critical vulnerability...

SUSE CVE-2024-10041

A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input stdin. As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This fla...

CVE-2024-10041

A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input stdin. As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This fla...