Windows-SignedBinary

生成具有不同哈希的 Windows 签名二进制文件 这个想法是为了绕过阻止已知“恶意”签名应用程序（如“regsvr32.exe”）的端点解决方案。我想找到一种方法来获得具有不同哈希的有效签名文件。 分析 使用 signtool verify /v /a cmd.exe C:\signchecksigntool verify /a /v cmd.exe Verifying: cmd.exe File is signed in catalog: C:\windows\system32\CatRoot\F750E6C3-38EE-11D1-85E5-...

cve-2025-2082-POV

CVE-2025-2082 – 函数指针覆写PoV（VCSEC风格） 此仓库演示了一个漏洞验证（PoV），模拟了一个受 CVE-2025-2082 启发的关键内存破坏缺陷，该缺陷发现于特斯拉的 VCSEC （车辆控制器安全）组件。 该漏洞允许攻击者利用有符号到无符号整数转换的错误以及 memcpy 操作中不当的内存边界验证，覆写一个 函数指针 。 此PoV演示的内容 如何在BLE消息中使用负数的 startIndex 导致内存写入 缓冲区起始位置之前 该内存区域可能包含一个关键的 函数指针 覆写该指针如何导致任意代码执行 C代码结构 struct VCSEC void funcptr; ...

CVE-2024-36401

CVE-2024-36401 基于 Chokapikk 的 CVE-2024-36401 改编，允许在受限环境中实现类似 webshell 的行为。同时支持自签名 TLS 会话，因为 HTTP 会话有点…… 用法： git clone https://github.com/keelanbrady1011/CVE-2024-36401 && cd CVE-2024-36401 pip install -r requirements.txt python3 geoshell.py --lhost OWNIP --lport PORT --url http://TARGET/ --ssl 原始...

Linux Distros Unpatched Vulnerability : CVE-2026-104988

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Dogtag PKI pki-core. The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth...

lolbin-poc

lolbin-poc 使用微软签名可执行文件作为 lolbin 的小型 PoC。 构建（32位） cmake -B build32 -A Win32 cmake --build build32 --config Release 构建（64位） cmake -B build64 -A x64 cmake --build build64 --config Release 使用方法 从此处下载 WinDbg，并将编译好的 dbgeng.dll 放到 windbg.exe 旁边。 额外内容 还有一些其他 DLL 可供使用：...

CVE-2026-85769

CVE-2026-85769 Heap out-of-bounds read in libtpms TPM 2.0 volatile-state deserialization. An unbounded optional-block skip in blockskipread advances the unmarshal cursor by an attacker-controlled 16-bit length and drives the signed remaining-size counter negative. Every downstream bounds check th...

CVE-2026-104988

A vulnerability exists in Dogtag PKI (pki-core) within the CMCAuthForEST authentication plugin. The system fails open when an EST fullcmc enrollment request is submitted using BasicAuth without an end-user TLS client certificate. Because the SSL_CLIENT_CERT session attribute retains the EST subsy...

CVE-2019-5420

CVE-2019-5420 Ruby-on-Rails は、development、test、production の3つの異なる環境で実行できます。当然、development や test で実行されているコードをインターネット上に公開すべきではありませんが、実際には（ステージング環境などで）よく発生します。 Ruby-on-Rails は「署名付きセッション signed-sessions」を使用して、アプリケーションを簡単にスケールできるようにしています。時間の経過とともに、セッションの処理方法は変化しました。バージョン 5.2.2 以降、セッションは JSON...

CVE-2026-17507

A flaw was found in Bouncy Castle's Messaging Layer Security MLS implementation. Due to an improper signed integer comparison, an out-of-range leaf identifier incorrectly bypasses group membership checks. A group member can exploit this flaw by sending a specially crafted message, causing unbound...

CVE-2026-104463 YesWiki before 4.6.7 Unauthenticated SSRF via ActivityPub Inbox

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route. Attackers sign requests with their own keyId while supplying internal actor URLs in...

CVE-2026-104463

YesWiki versions prior to 4.6.7 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker can trigger server-side requests by sending signed Follow activities to the public forms actor inbox route. By signing requests with their own keyId and supplying inte...

conductai

Conduct AI 智能体的治理。60 秒内交付。 为工程团队打造。10 分钟安装。从第一天起就为 CISO 提供证据。 60 秒试用（无需安装） curl -fsSL conductai.ai/install | sh 提示输入邮箱 + 公司，开通一个 7 天试用工作区，生成 /.conduct/env，其中包含 ANTHROPICBA...

CVE-2026-17507 MLS membership checks compare a uint32 leaf_index as signed, admitting an out-of-range sender

In Bouncy Castle for Java before 1.86, the MLS implementation org.bouncycastle.mls holds RFC 9420's uint32 leafindex in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legitimate encoding rather than malformed input, and it must still decode, since the M...

CVE-2026-17507 MLS membership checks compare a uint32 leaf_index as signed, admitting an out-of-range sender

In Bouncy Castle for Java before 1.86, the MLS implementation org.bouncycastle.mls holds RFC 9420's uint32 leafindex in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legitimate encoding rather than malformed input, and it must still decode, since the M...

CVE-2026-17507 MLS membership checks compare a uint32 leaf_index as signed, admitting an out-of-range sender

In Bouncy Castle for Java before 1.86, the MLS implementation org.bouncycastle.mls holds RFC 9420's uint32 leafindex in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legitimate encoding rather than malformed input, and it must still decode, since the M...

Quiksand-CVE-2023-24012

DDS Security Test ROS 2 DDS セキュリティ研究テスト環境、ROS 2 Foxy ベース。 プロジェクト概要 このプロジェクトは、ROS 2 SROS2 セキュリティフレームワークにおける権限バイパスの脆弱性を実演します。署名された権限ファイルを改変することで、攻撃者はノードに本来購読すべきでないトピックを購読させることができます。 環境要件 Docker クイックスタート イメージの構築 docker build -t dds-test . PoC の実行 docker run -it dds-test ./poc.sh PoC スクリプトの説明 poc.sh...

PT-2026-104127

In Bouncy Castle for Java before 1.86, the MLS implementation org.bouncycastle.mls holds RFC 9420's uint32 leaf index in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legitimate encoding rather than malformed input, and it must still decode, since the...

CVE-2025-54424

CVE-2025-54424 CVE-2025-54424：1Panel クライアント証明書バイパスRCE脆弱性 統合ツール（スキャン＋エクスプロイト） 脆弱性の概要 1Panel は、オープンソースでモダンな Linux 運用管理パネルであり、Web サイトのデプロイ、サーバー管理、サービスの実行をグラフィカルインターフェースで提供します。 影響を受けるバージョンでは、Agent 側の TLS 認証ポリシーが tls.RequireAnyClientCert に設定されており、証明書の提示のみを要求し、その信頼性は検証しません。攻撃者は自己署名証明書を使用して TLS...

PCP: PCP: Denial of Service due to signed integer overflow

A signed integer overflow in the PCP pmGetPDU function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service DoS for subsequent packet reads...

PCP: PCP: Denial of Service due to signed integer overflow

A signed integer overflow in the PCP pmGetPDU function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service DoS for subsequent packet reads...