CVE-2013-2028-x64-bypass-ssp-and-pie-PoC

für die Umgehung von NX PIE SSP ASLR dieser poc ist nicht stabil. manchmal wird der HTTP-Dienst ausfallen. Sie sollten das morecore-offset korrigieren und die richtige libc-Datei auswählen...

CVE-2025-50154-Aggressor-Script

LNK Weaponizer - Script Aggressor per Cobalt Strike Uno script Aggressor completo per Cobalt Strike che weaponizza ed esegue file LNK e Library-MS dannosi per la divulgazione di hash NTLMv2-SSP tramite SMB. Include tecniche di bypass per CVE-2025-24054. ⚠️ DISCLAIMER Questo strumento è solo a scop...

CVE-2024-38063

CVE-2024-38063 - SSP H3 इस सेटअप वीडियो वाले के लिए मैंने Windows 22H2 19045 और बिल्ड 2468 का उपयोग किया है। यह CVE 4780 तक पैच नहीं किया गया है। मैंने इसे Qemu/KVM के साथ आज़माया, लेकिन नेटवर्क एडॉप्टर पैकेट को कोलेसिंग नहीं कर रहा था जैसा कि मैंने tcpdump के साथ जांचा। समाधान VirtualBox,...

DragonCastle

DragonCastle Una PoC che combina la tecnica di movimento laterale AutodialDLL e SSP per estrarre hash NTLM dal processo LSASS. Descrizione Carica una DLL sulla macchina target. Quindi abilita il registro remoto per modificare la voce AutodialDLL e avvia/riavvia il servizio BITS. Svchosts caricher...

CVE-2025-24054

Rivelazione Hash NTLMv2-SSP Zero Click in Windows File Explorer 🎥 Dimostrazione POC + Bypass patch di marzo 2025 🎥 bypass patch Clicca sull'immagine sopra per vedere la dimostrazione della vulnerabilità 📋 Panoramica Tecnica Questo repository fornisce un framework di ricerca completo che analizza ...

ms-photos_NTLM_Leak

Microsoft ms-photos URI NTLM लीक एक क्लिक से ब्राउज़रों से NTLM हैश लीक करने की अनुमति देने वाली नई भेद्यता द्वारा Ruben Enkaoua विवरण Microsoft ms-photos URI स्कीम fileName को पैरामीटर के रूप में लेती है, जिसे UNC पथ के साथ सबमिट किया जा सकता है, जिससे खोलने पर NTLMv2-SSP हैश लीक हो जाते हैं। एक...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: MGMT: Fixed a memory leak in setsspcomplete. The memory leak was fixed in setsspcomplete, where the mgmtpendingcmd structures are not freed after they are removed from the pending list. Commit 302a1f674c00 “Bluetoot...

CVE-2026-46056

The CVE-2026-46056 entry documents a Linux kernel Bluetooth UAF vulnerability in the SSP passkey handlers (hci_event path). The issue arises when hci_conn lookup and field access are performed without holding the hdev lock, creating a window where a connection could be freed concurrently in hci_u...

CVE-2026-46056

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix potential UAF in SSP passkey handlers hciconn lookup and field access must be covered by hdev lock in hciuserpasskeynotifyevt and hcikeypressnotifyevt, otherwise the connection can be freed concurrently...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: cifs: A memory leak occurs when the build ntlmssp negotiate blob operation fails. There is a memory leak when mounting CIFS shares: - Unreferenced object: 0xffff888166059600 size 448 Command: “mount.cifs”, PID: 51391, Jiffies:...

SUSE CVE-2026-23151

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix memory leak in setsspcomplete Fix memory leak in setsspcomplete where mgmtpendingcmd structures are not freed after being removed from the pending list. Commit 302a1f674c00 "Bluetooth: MGMT: Fix possible UAFs...

CVE-2026-23151

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix memory leak in setsspcomplete Fix memory leak in setsspcomplete where mgmtpendingcmd structures are not freed after being removed from the pending list. Commit 302a1f674c00 "Bluetooth: MGMT: Fix possible UAFs...

UBUNTU-CVE-2026-23151

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix memory leak in setsspcomplete Fix memory leak in setsspcomplete where mgmtpendingcmd structures are not freed after being removed from the pending list. Commit 302a1f674c00 "Bluetooth: MGMT: Fix possible UAFs...

CVE-2026-23151

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix memory leak in setsspcomplete Fix memory leak in setsspcomplete where mgmtpendingcmd structures are not freed after being removed from the pending list. Commit 302a1f674c00 "Bluetooth: MGMT: Fix possible UAFs...

CVE-2026-23151 Bluetooth: MGMT: Fix memory leak in set_ssp_complete

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix memory leak in setsspcomplete Fix memory leak in setsspcomplete where mgmtpendingcmd structures are not freed after being removed from the pending list. Commit 302a1f674c00 "Bluetooth: MGMT: Fix possible UAFs...

CVE-2026-23151 Bluetooth: MGMT: Fix memory leak in set_ssp_complete

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix memory leak in setsspcomplete Fix memory leak in setsspcomplete where mgmtpendingcmd structures are not freed after being removed from the pending list. Commit 302a1f674c00 "Bluetooth: MGMT: Fix possible UAFs...

PT-2026-8146

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak exists in the Bluetooth MGMT subsystem, specifically within the set ssp complete function. The issue arises from missing calls to mgmt pending free in both success and erro...

WordPress Plugin SSP Debug Information Disclosure Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. An information disclosure vulnerability exists in WordPress plugin SSP Debug, which stems from...

CVE-2025-13494

The SSP Debug plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.0. This is due to the plugin storing PHP error logs in a predictable, web-accessible location wp-content/uploads/ssp-debug/ssp-debug.log without any access controls. This...

CVE-2025-13494

The SSP Debug plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.0. This is due to the plugin storing PHP error logs in a predictable, web-accessible location wp-content/uploads/ssp-debug/ssp-debug.log without any access controls. This...