Cronos-Rootkit

Cronos Rootkit Cronos는 Windows 10/11 x64 링 0rootkit 루트킷입니다. Cronos는 프로세스를 숨기고, 토큰 조작을 통해 프로세스를 보호하고 권한을 상승시킬 수 있습니다. 기능 프로세스 숨기기 프로세스 권한 상승 프로세스 보호 기여 기여는 언제나 환영합니다...

CVE-2018-0114-Exploit

CVE-2018-0114-Exploit Cisco node-jose 오픈 소스 라이브러리 0.11.0 이전 버전의 취약점으로 인해 인증되지 않은 원격 공격자가 토큰에 포함된 키를 사용하여 토큰에 다시 서명할 수 있습니다. 이 취약점은 node-jose가 JSON 웹 토큰JWT에 대해 JSON 웹 서명JWS 표준을 따르기 때문에 발생합니다. 이 표준은 JWS의 헤더에 공개 키를 나타내는 JSON 웹 키JWK를 포함할 수 있도록 지정합니다. 이 공개 키는 검증을 위해 신뢰됩니다. 공격자는 원래 서명을 제거하고, 헤더에 새 공개 키...

CVE-2026-79294

CVE-2026-79294 CVE-2026-79294 — Stored XSS in Moonshot AI Kimi's HTML artifact Preview, delivered through the public Share view, leading to session token exfiltration and demonstrated account takeover. Responsible disclosure advisory. Vulnerability Details Vulnerability Type: Stored/Stored-like...

CVE-2026-103957

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...

CVE-2023-54405

H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating the caller-supplied token parameter...

CVE-2026-103957 Server-side request forgery in the OAuth2 discovery handling in Loom for AWS

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...

EUVD-2026-91772

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...

CVE-2026-103957

A Server-side request forgery (SSRF) vulnerability exists in the OAuth2 discovery handling of Loom for AWS versions prior to 1.7.0 . An authenticated remote user can exploit this by supplying a crafted discovery document address when registering a tool server or remote agent configured for delega...

CVE-2026-103957 Server-side request forgery in the OAuth2 discovery handling in Loom for AWS

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...

CVE-2026-103957 Server-side request forgery in the OAuth2 discovery handling in Loom for AWS

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...

CVE-2023-54405 H3C CVM Unauthenticated File Upload via fileUpload/upload Token

H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating the caller-supplied token parameter...

EUVD-2023-60704

H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating the caller-supplied token parameter...

CVE-2023-54405 H3C CVM Unauthenticated File Upload via fileUpload/upload Token

H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating the caller-supplied token parameter...

CVE-2023-54405

The H3C CVM (Cloud Virtualization Management) component of the H3C CAS cloud platform is vulnerable to an unauthenticated arbitrary file upload flaw in the /cas/fileUpload/upload endpoint. The root cause is the lack of restrictions on file types and the failure to sanitize the caller-supplied tok...

cve-2026-62737-lab

CVE-2026-62737: クラッシュからラボ支援によるSYSTEM取得へ これは、元のCVE-2026-62737のwriteup （ExecutionContext.sys の任意カーネル間接呼び出し）の続編です。クラッシュ PoCを、cmd.exe をSYSTEMとして起動する実用的なトークンスワップチェーンに 変換します。ただし、デバッガがアドレスを提供し、ROPチェーンをカーネル メモリに書き込むラボ環境でのみ機能します。これはスタンドアロンのエクスプロイトではありません 。 動作内容 1. 低権限ユーザーとして、KLoaderプロキシを介してExecutionContex...

CVE-2026-9198

CVE-2026-9198 脆弱性の原因： IBM Langflow OSSは、Agent自動化ワークフローの構築とデプロイに特化したオープンソースソフトウェアです IBM Langflow OSS 1.0.0 から 1.10.0 では、自動ログイン（autologin が true）がデフォルトで有効になっています このモードでは、/api/v1/autologinエンドポイントにアクセスすると、スーパーユーザーのトークンが直接返されます このトークンを使用して、/api/v1/validate/codeエンドポイントにアクセスできます POST /api/v1/validate/co...

token-priv

토큰 권한 남용을 통한 EoP 2017년 8월 Bryan Alexander @dronesec Stephen Breen @breenmachine 이 저장소에는 권한 상승을 위해 토큰 권한을 남용하는 연구에 관한 모든 코드와 Phrack 스타일의 논문이 포함되어 있습니다. 질문, 아이디어, 욕설, 버그가 있으면 언제든지 연락해 주세요. 이 저장소는 세 부분으로 구성되어 있습니다: lib/ – 보조 스크립트를 포함합니다 현재는 pykd 토큰 스크립트뿐입니다. poptoke/ – 코드의 대부분을 차지합니다. 프로젝트 형태로 구성되어...

TP-Link-Archer-CR-700-XSS-Exploit

TP-Link-Archer-CR-700-XSS-Exploit TP-Link Archer CR-700 라우터 익스플로잇. TP-Link에 책임 공개됨 1단계- Linux 머신Kali 또는 Ubuntu에서 다음 명령을 입력하세요. gedit /etc/dhcp/dhclient.conf 아래 줄을 주석 처리하세요. send host-name = gethostname; 그 줄을 그 아래 줄에 복사하고 gethostname 함수를 아래와 같이 XSS 스크립트로 변경하세요. send host-name = "alert5"; 2단계: 변경 사...

EUVD-2026-91742

MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...

CVE-2026-104906 MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output

MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...