BIT-NEO4J-ENTERPRISE-2026-1471 Caching of authentication context

Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.1.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO UserInfo endpoint. We recomme...

BIT-NEO4J-ENTERPRISE-2026-14587 Unathenticated connection can hold Bolt channel open

Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for mo...

BIT-NEO4J-ENTERPRISE-2026-1337 Insufficient escaping of unicode characters in query log

Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat...

Security Bulletin: Multiple Vulnerabilities in IBM Concert Software

Summary Multiple vulnerabilities were addressed in IBM Concert Software version 3.0.0 Vulnerability Details CVEID:CVE-2026-26996 DESCRIPTION: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular...

TryHack3M-Bricks-Heist

TryHack3M: Ограбление Bricks Эксплойт • Writeup • CTF-задача Полный репозиторий, содержащий собственный эксплойт и подробное описание прохождения задачи TryHack3M: Bricks Heist Быстрый старт • Структура репозитория • Эксплойт • Writeup • Отказ от ответственности Обзор В этом репозитории...

vulnerabilities in Adobe Campaign Classic

Adobe has identified several vulnerabilities in Adobe Campaign Classic. These vulnerabilities involve Server-Side Request Forgery SSRF and OS Command Injection. The SSRF vulnerability allows attackers to manipulate requests on the server, which can lead to the execution of arbitrary code without...

CVE-2026-31431-Copy-Fail-Detection-Toolkit

Kit de Detección CVE-2026-31431 Copy Fail Kit de detección y análisis para CVE-2026-31431 "Copy Fail": una vulnerabilidad crítica de escalada de privilegios local en Linux que afecta a distribuciones desde 2017 en adelante. Resumen de la Vulnerabilidad CVE-2026-31431 explota una falla lógica en l...

Twenty-Three-Scanner

🛰️ Twenty-Three Scanner Telnetd 서비스 중 CVE-2026-24061 취약점에 영향을 받는 서비스를 탐지하기 위한 강력하고 , 빠르며 , 우아한 스캐너입니다. 순수 Python 표준 라이브러리로 제작되었으며, 외부 의존성이 전혀 필요 없습니다. -A32D2A?style=for-the-badge 🔗 목차 ⚖️ 라이선스 🧩 기능 ☣️ 취약점 세부 정보 ⚡ 서비스 상태 🧪 개념 증명 PoC 💥 영향을 받는 버전 🧵 패치된 버전 ⚔️ 공격 벡터 🚨 CVSS 점수...

CVE-2026-22812

CVE-2026-22812 CVE-2026-22812 - 스캔을 위한 OpenCode 인증되지 않은 RCE Nuclei 템플릿. burp suite 요청 root@kitploit: POST /session HTTP/1.1 Host: target.com User-Agent: Mozilla/5.0 X11; Linux x8664 Content-Type: application/json Content-Length: 2 root@kitploit: POST /session/"id"/shell HTTP/1.1 Host: target.com...

Vulnerabilities found in Ubiquiti’s UniFi products

Ubiquiti has identified vulnerabilities in various UniFi products, including UniFi Protect, UniFi OS, UniFi Network Application, UniFi Connect, UniFi Access Application, UniFi OS Server, UID Enterprise Agent, UniFi Connect Display Cast Pro, UniFi Enterprise Audio/Video Bridge, and UniFi Talk. The...

CVE-2022-31061

CVE-2022-31061 PoC для GLPI CVE-2022-31061 Proof of Concept для GLPI = 9.3.0 и 10.0.2 - Неавторизованная SQL-инъекция на странице входа Правовое предупреждение : Использование этого сценария для атаки на цель без обоюдного согласия незаконно. Ответственность конечного пользователя — соблюдать все...

CVE-2021-4034

CVE-2021-4034 Это POC для уязвимости, обнаруженной в бинарном файле pkexec из polkit, который используется для запуска программ от имени других пользователей. Для углублённого изучения: https://access.redhat.com/security/vulnerabilities/RHSB-2022-001 Запуск root@kitploit: gcc poc.c -o poc && ./po...

promptfoo v0.122.1

Promptfoo: LLM evals & red teaming promptfoo is a CLI and library for evaluating and red-teaming LLM apps. Stop the trial-and-error approach - start shipping secure, reliable AI apps. Website · Getting Started · Red Teaming · Documentation · Discord Promptfoo is now part of OpenAI. Promptfoo...

CVE-2024-32113

CVE-2024-32113 Apache OFBIZ 일괄 스캐닝 주의: 이 도구는 불법 공격에 사용되는 것을 지원하지 않습니다. 이 도구는 기술적 교류만을 목적으로 합니다. 참고: 이 도구는 어떠한 불법 공격도 지원하지 않습니다. 기술 교류만을 목적으로 합니다. 주의: 본인은 누구든 본 도구를 사용하여 불법 공격을 하는 것을 지원하지 않습니다. 본 도구는 기술 교류 전용입니다. 도움말 root@kitploit: CVE-2024-32113 Batch Scanning optional arguments: -h, --help show...

CVE-2025-27591-PoC

CVE-2025-27591 PoC: Below v0.9.0에서의 로컬 권한 상승 CVE-2025-27591의 개념 증명PoC으로, 로컬의 권한이 없는 사용자가 심볼릭 링크 공격을 통해 권한을 root로 상승시킬 수 있는 취약점입니다. 🕵️‍♂️ 기술적 세부 사항 이 취약점은 Below 서비스v0.9.0 미만 버전에 영향을 미칩니다. 이 서비스는 /var/log/below 디렉토리를 전 세계에서 쓰기 가능한 권한0777으로 생성하여, 권한이 없는 로컬 사용자가 심볼릭 링크를 재배치하고 /etc/shadow와 같은 중요 파일을...

dh-CVE_2016_2098

== README Доказательство концепции для https://groups.google.com/forum/!topic/rubyonrails-security/ly-IH-fxrQ == Эксплуатация: 1. Вы должны запускать rails сервер только так, чтобы быть уверенными, что это не сделает вас уязвимыми для эксплуатации. 2. Запустите rails s 3. Выполните следующую...

scavenger_scanner

Сканер IOC CVE-2025-54313 Кроссплатформенные сканеры для обнаружения индикаторов компрометации IOC, связанных с атакой на цепочку поставок eslint-config-prettier CVE-2025-54313. 18 июля 2025 года несколько популярных npm-пакетов были скомпрометированы в результате фишинговой атаки. Злоумышленник...

CVE-2022-46152

CVE-2022-46152 OP-TEE OScleanupshmrefs Lecture hors limites — Environnement de reproduction Référence : https://optee.readthedocs.io/en/latest/building/devices/qemu.htmlqemu-v8 Avis de sécurité : https://github.com/OP-TEE/opteeos/security/advisories/GHSA-65w8-6mrg-52g7 Aperçu de la vulnérabilité...

CVE-2022-1292

CVE-2022-1292 POC Описание root@kitploit: The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute...

CVE-2026-80586

A flaw was found in the Linux kernel. A remote attacker could send a malformed Data Sequence Signal DSS with an incorrect size. This could lead to inconsistencies or access to uninitialized data within the kernel...