CVE-2022-40363

CVE-2022-40363 Flipper Devices Inc. 生产的 Flipper Zero（v0.65.2 之前版本）中，组件 nfcdeviceloadmifareuldata 存在缓冲区溢出漏洞，攻击者可通过特制的 NFC 文件导致拒绝服务（DoS）。 身份验证| 复杂度| 攻击向量 ---|---|--- 不可用| 不可用| 不可用 机密性| 完整性| 可用性 ---|---|--- 不可用| 不可用| 不可用 CVSS 评分：不可用 参考链接 https://vvx7.io/posts/2022/09/your-amiibos-haunted/...

Aimhubio Aim Server 3.19.3 - Arbitrary File Overwrite

A vulnerability in the backuprun function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the runhash and repo.path parameters, which can be manipulated to create an...

Hoverfly < 1.10.3 - Arbitrary File Read

Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The /api/v2/simulation POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary...

Cisco Unified IP Conference Station 7937G - Denial-of-Service

Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to restart the device remotely via specially crafted packets that can cause a denial-of-service condition. Note: We cannot prove this vulnerability exists. Out of an abundance of caution, this CVE is being assigned...

Mitel MiCollab - Information Disclosure & Denial of Service

Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 contain a vulnerability in the TP-240 component caused by improper handling, letting remote attackers obtain sensitive information and cause denial of service, exploit requires remote access. id: CVE-2022-26143 info: name:...

GeoServer - XML External Entity Injection

GeoServer 2.26.0 to 2.26.2 and 2.25.6 contains an XML External Entity XXE injection caused by insufficient sanitization of XML input in /geoserver/wms GetMap operation, letting attackers disclose files or cause DoS, exploit requires crafted XML input. id: CVE-2025-58360 info: name: GeoServer - XM...

Apache Struts XWork - XML External Entity Injection

Apache Struts 2.0.0 2.2.1 and 2.2.1 = versions = 6.1.0 contain an XML external entity injection caused by missing XML validation, letting attackers potentially disclose files or cause denial of service, exploit requires crafted XML input id: CVE-2025-68493 info: name: Apache Struts XWork - XML...

Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0011)

Before Kentico Xperience 13 Hotfix 173, this vulnerability can be exploited with any username provided. For Hotfix = 173 and = 173 and 178, this vulnerability can be exploited only if you provide a valid Staging Service username default: admin impact: | Unauthenticated attackers can bypass...

Grafana - Improper Access Control

Grafana 2.x through 6.x before 6.3.4 is susceptible to improper access control. An attacker can delete and create arbitrary snapshots, leading to denial of service. id: CVE-2019-15043 info: name: Grafana - Improper Access Control author: Joshua Rogers severity: high description: | Grafana 2.x...

GeoServer OGC Filter - SQL Injection

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language CQL as part of the Web Feature Service WFS and Web Map Service WMS protocols. CQL is...

CommScope Ruckus IoT Controller - Information Disclosure

CommScope Ruckus IoT Controller is susceptible to information disclosure vulnerabilities because a 'service details' API endpoint discloses system and configuration information to an attacker without requiring authentication. This information includes DNS and NTP servers that the devices use for...

Grafana Unauthenticated Snapshot Creation

Grafana 6.7.3 through 7.4.1 snapshot functionality can allow an unauthenticated remote attacker to trigger a Denial of Service via a remote API call if a commonly used configuration is set. id: CVE-2021-27358 info: name: Grafana Unauthenticated Snapshot Creation author: pdteam,bing0o severity: hi...

Debug Endpoint pprof - Exposure Detection

The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8,...

CLEANSTART-2026-KJ02957 pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service

CVE-2026-66257 affects multiple packages. A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. See references for individual vulnerability details...

CVE-2018-16706

CVE-2018-16706 或者如何关闭我的电视 $ nmap 192.168.1.55 -p 9080 PORT STATE SERVICE 9080/tcp open glrpc Nmap done: 1 IP address 1 host up scanned in 0.05 seconds CVE详细信息 https://www.cvedetails.com/cve/CVE-2018-16706/...

RazerEoP

RazerEoP Razer Synapse 3 宏模块中任意文件删除/移动的 PoC。 该模块允许用户将创建的宏导出到磁盘上的文件，文件操作由以 nt authority\system 身份运行的 razer 服务完成。 我尝试通过他们的 BB 计划向 razer 报告此问题，得到的回复是这不是一个 bug，而是一个漏洞 🤣。 随后我将其报告给 HackerOne，但由于报告年代久远，该报告被以 Informative 状态关闭。 受影响版本 为 3.7.1209.121307 及以下。 任意删除...

SharpStartWebclient

SharpStartWebclient 从非特权会话运行，以启动 WebClient 服务并实现绝妙的提权。 Beacon Object File 的 C 移植版本，源自 https://github.com/outflanknl/C2-Tool-Collection/blob/main/BOF/StartWebClient/SOURCE/StartWebClient.c...

RasmanPotato

RasmanPotato 感谢 @Wh04m1001 一直以来的持续交流 与其他 potato 类似的又一个 potato，利用 RasMan 服务进行权限提升 适用于 Windows 10（未测试 11）、Windows Server 2012 - 2019（未测试 2022） 用法 root@kitploit: magicRasMan v0.1 Provided that the current user has the SeImpersonate privilege, this tool will have an escalation to SYSTEM Arguments: -c...

MultiExploit

多服务漏洞扫描器 支持的漏洞与攻击向量 Microsoft SQL Server 漏洞 CVE-2023-21173 ：SQL Server 2022 中的远程代码执行 潜在利用： 弱认证配置 错误配置的服务器主体 xpcmdshell 滥用 高级选项操作 常见漏洞类别 1. 认证绕过 弱/默认凭据 空密码尝试 错误配置的认证机制 2. 服务枚举 FTP 匿名访问 开放的数据库端口 暴露的服务信息 3. 潜在攻击面 MSSQL 远程命令执行 FTP 信息泄露 网络服务指纹识别 目标服务 Microsoft SQL Server FTP 服务 Windows 远程管理 WinRM...

CVE-2015-1474_poc

此代码旨在作为CVE-2015-1474的PoC尝试。 该代码基于screencap命令的代码，但生成一个恶意Parcel，当反序列化时会导致surfaceflinger崩溃。 更多信息请参考 http://forum.xda-developers.com/kindle-fire-hdx/orig-development/evaluating-cve-2015-1474-to-escalate-to-t3045163。 克隆至 frameworks/base/cmds/badscreencap，并使用 mmm frameworks/base/cmds/badscreencap 编译。...