CVE-2018-13379

🛡️ CVE-2018-13379 - Fortinet SSL VPN 脆弱性 🔍 概要 CVE-2018-13379 は Fortinet FortiOS SSL VPN における 重大なパストラバーサル 脆弱性です。 攻撃者が VPN ウェブセッションファイルをダウンロード し、機密情報を抽出することを可能にします。 影響: 情報漏洩（ユーザー名、セッショントークン） CVSSv3: 8.6（高） 悪用条件: リモート、認証不要 💻 影響を受けるバージョン FortiOS 5.4.6 – 5.4.12 FortiOS 5.6.3 – 5.6.7 FortiOS 6.0.0 –...

CVE-2026-41940---cPanel-WHM-check

IOC チェックセッションファイル 概要 iocchecksessionsfiles.sh は、cPanel 公式セキュリティアドバイザリで参照されている cPanel 提供の検出スクリプトです。 セキュリティ: CVE-2026-41940 - cPanel & WHM / WP2 セキュリティアップデート 2026年4月28日 このスクリプトは、cPanel/WHM のセッションファイルをスキャンして、CVE-2026-41940 に関連する侵害指標（IOC）の疑わしい兆候、失敗した悪用試行、および確認された悪用の痕跡を検出するために使用されます。 CVE-2026-41940...

cpanel-cve-2026-41940-ioc

CVE-2026-41940 IOC スキャナー cPanel/WHM の認証バイパス（CVE-2026-41940）を検出するスクリプトです。11.40 以降のすべての cPanel バージョンに影響します。 これは上流の cPanel 検出スクリプトを書き直したもので、誤検知の修正とログ相関の追加が行われています。 機能 /var/cpanel/sessions/raw/ をスキャンして改行インジェクションの悪用の兆候を示すセッションファイルを検出し、疑わしい IP とセッショントークンを cPanel...

POC-CVE-2025-24813

CVE-2025-24813 – 데모 환경PoC 이 저장소는 CVE-2025-24813의 동작을 관찰하기 위해 구축된 간단한 애플리케이션을 포함합니다. 이는 Apache Tomcat 의 최신 취약점으로, DefaultServlet 에서 쓰기 활성화 readonly=false 시 HTTP PUT을 통한 안전하지 않은 쓰기 작업partial PUT / Content-Range 지원을 허용하여 세션 파일을 포함한 중요한 파일의 덮어쓰기를 가능하게 하며, 악의적인 역직렬화 발생 시 RCE 시나리오를 가능하게 합니다. 이 PoC에 대하여...

Exploit for Missing Authentication for Critical Function in Cpanel

CVE-2026-41940 ⚠ This tool is created solely for education...

EUVD-2019-20177

Mobatek MobaXterm 12.1 contains a structured exception handling SEH based buffer overflow vulnerability in the username field of session files that allows remote attackers to execute arbitrary code. Attackers can craft a malicious MobaXterm sessions file with overflow data that triggers the...

CVE-2019-25741 Mobatek MobaXterm 12.1 Buffer Overflow via Sessions File

Mobatek MobaXterm 12.1 contains a structured exception handling SEH based buffer overflow vulnerability in the username field of session files that allows remote attackers to execute arbitrary code. Attackers can craft a malicious MobaXterm sessions file with overflow data that triggers the...

PT-2026-46211

Mobatek MobaXterm 12.1 contains a structured exception handling SEH based buffer overflow vulnerability in the username field of session files that allows remote attackers to execute arbitrary code. Attackers can craft a malicious MobaXterm sessions file with overflow data that triggers the...

CVE-2019-25741: Buffer Copy without Checking Size of Input

Mobatek MobaXterm 12.1 contains a structured exception handling SEH based buffer overflow vulnerability in the username field of session files that allows remote attackers to execute arbitrary code. Attackers can craft a malicious MobaXterm sessions file with overflow data that triggers the...

CVE-2026-45306

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the fix for CVE-2026-33509 prevents setting storagefolder inside PKGDIR or userdir, but does NOT protect the Flask session directory /tmp/pyLoad/flask. An authenticated attacker can set storagefolder to...

CVE-2026-45306 pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the fix for CVE-2026-33509 prevents setting storagefolder inside PKGDIR or userdir, but does NOT protect the Flask session directory /tmp/pyLoad/flask. An authenticated attacker can set storagefolder to...

Exploit for Missing Authentication for Critical Function in Cpanel

IOC Check Sessions Files Overview iocchecksessionsfile...

Vulnerability handling functions in cPanel and WHM

cPanel has identified a vulnerability in its cPanel and WHM products, including versions after 11.40 and before the specific patched releases. The vulnerability involves an authentication bypass that occurs due to the injection of CRLF characters in session files, allowing attackers to impersonat...

PT-2026-35811

Name of the Vulnerable Software and Affected Versions GRASSMARLIN versions prior to 3.2.1 GRASSMARLIN version 3.2.1 Description Improper handling of XML input occurs due to insufficient hardening of the XML parsing process. This allows crafted session data, specifically within session files .gm3,...

Incorrect Authorization

Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Incorrect Authorization via the storagefolder configuration option, which allows a user with SETTINGS and ADD permissions to redirect downloads to the Flask...

MAL-2026-2118 Malicious code in hash-utils-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4177b7c46ecbfa35116b35a2a491107d0514cd6551a447b7213ef6e097172939 During importing the module, the code attempts to exfiltrate sensitive Telegram's client session files. --- Category: MALICIOUS - The campaign has clearly...

CVE-2026-28482

OpenClaw versions prior to 2026.2.12 construct transcript file paths using unsanitized sessionId parameters and sessionFile paths without enforcing directory containment. Authenticated attackers can exploit path traversal sequences like ../../etc/passwd in sessionId or sessionFile parameters to...

Malicious code in hashtools32 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 689514b83cd6496b0a4213d26325e73cd2c4f0e19128b969d19797bcdd4b131d During import, the package attempts to exfiltrate sensitive Telegram session files --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-1080 Malicious code in hashtools32 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 689514b83cd6496b0a4213d26325e73cd2c4f0e19128b969d19797bcdd4b131d During import, the package attempts to exfiltrate sensitive Telegram session files --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Unsafe Deserialization

Scapy is vulnerable to unsafe deserialization. The vulnerability is due to insecure handling of serialized session files, which allows an attacker to execute arbitrary code by tricking a user into loading a malicious session file via the -s option...