PrivFu

PrivFu Extensão do WinDbg em modo kernel e PoCs para testar como as permissões de token funcionam. Existem repositórios e artigos notáveis sobre abuso de privilégios de token, como o Priv2Admin de Grzegorz Tworek. Os códigos neste repositório têm o objetivo de ajudar a investigar como as permissõ...

xattr-oob-swap

xattr-oob-swap CVE-2020-27904: macOS 10.15.x और उससे नीचे के लिए एक tfp0 बग। BlackHat ASIA 2021 में मेरे वार्ता के लिए डेमो शोषण कोड। यह भेद्यता macOS Big Sur 11.0 में और नवीनतम 10.15 और 10.14 सुरक्षा अद्यतन में ठीक कर दी गई है। वारंटी इसे अपने जोखिम पर उपयोग करें। यह आपके macOS को पैनिक करा सकता...

GHSA-XXPJ-Q764-9R6Q NocoDB: Missing Ownership Check in MCP Attachment Read

Summary A low-privilege MCP token holder with knowledge of an attachment path could read any file in shared storage, including attachments belonging to other bases and workspaces, because the MCP readAttachment tool did not verify the file's ownership. Details The MCP readAttachment tool accepts...

EUVD-2022-3787

Malicious code in bioql PyPI...

Bottinelli Informatical Vedo Suite Access Control Error Vulnerability

Bottinelli Informatical Vedo Suite is an enterprise software suite for the textile and design industry from Bottinelli Informatica, Italy. An access control error vulnerability exists in Bottinelli Informatical Vedo Suite, which can be exploited by an attacker to obtain an elevated privilege JWT...

CVE-2024-50634

A vulnerability in a weak JWT token in Watcharr v1.43.0 and below allows attackers to perform privilege escalation using a crafted JWT token. This vulnerability is not limited to privilege escalation but also affects all functions that require authentication...

CVE-2022-23741

An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate to full admin/owner privileges. An attacker would require an account with admin access to install a malicious GitHub App. This vulnerability was fixed in...

SUSE CVE-2021-32688

Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server supports application specific tokens for authentication purposes. These tokens are supposed to be granted to a specific applications e.g. DAV sync clients, and can also be configured by the user to not have any...

Important: Red Hat Security Advisory: pcs security update

An update for pcs is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...