HTC

CCTVをハック DVRの認証情報が流出 | CVE-2018-9995 | CCTVに漏洩したユーザー名でログインアクセスを取得 使用方法 root@kitploit: https://www.zoomeye.org/ を開く このキーワード '/login.rsp' を検索 IPとポートが取得されるのを待つ $ python3 thecctv.py 詳細情報 OS| 言語| 連絡先 ---|---|--- Linux Ubuntu| Pythonv3| [email protected] Keyw0rd がアップロード 3...

CVE-2025-29972

CVE-2025-29927 - Next.js의 심각한 보안 취약점 개요 CVE-2025-29927은 풀스택 웹 애플리케이션 구축을 위한 인기 있는 React 프레임워크인 Next.js 에 영향을 미치는 심각한 보안 취약점입니다. 이 결함으로 인해 공격자는 Next.js 미들웨어에 구현된 권한 부여 검사를 우회하여 애플리케이션의 관리자 페이지 나 사용자 대시보드 와 같은 민감한 영역에 무단으로 접근할 수 있습니다. 취약점 상세 이 취약점은 내부 x-middleware-subrequest 헤더의 부적절한 처리에서 발생합니다. 이...

CVE-2024-32371

CVE-2024-32371 설명 설명 CVE-2024-32371로 식별된 취약점은 공격자가 type 매개변수의 값을 1에서 0으로 변경하여 권한을 상승시킬 수 있도록 합니다. 이 취약점을 통해 일반 사용자 계정을 가진 공격자가 자신의 권한을 상승시키고 시스템에 대한 관리자 액세스 권한을 획득할 수 있습니다. 버전: HSC Mailinspector 5.2.17-3에서 발견되었지만 5.2.18까지의 모든 버전에 적용됩니다. 취약한 매개변수 매개변수: type 영향을 받는 값: 값을 1일반 사용자에서 0관리자으로 변경 취약점 설명 ...

CVE-2019-3403

CVE-2019-3403 CVE-2019-3403を悪用してJIRAアプリケーションからすべてのユーザーを簡単にスクレイピングできるようにしたかったので、このスクリプトを急ごしらえで作りました。決してきれいなコードではありませんし、1000人を超えるユーザーを返すリクエストには対応していません（最初の1000人に切り詰められます）が、脆弱性のあるJIRAサーバーからすべてのユーザーを素早くスクレイピングできます。 使用方法 root@kitploit: usage: scrapejira.py -h -d DOMAIN -q QUERY -o OUT -v Scrape User...

CVE-2022-22972

CVE-2022-22972 vmware 認証バイパス root@kitploit: -host string Auth Servers,bugs365.com -url string Vul url,-url https://xxx.com -user string username default "administrator"...

CVE-2023-27350-POC

CVE-2023-27350-POC 설명: 이 도구는 PaperCut MF/NG 버전 8.0 이상, 20.1.7, 21.2.11 또는 22.0.9 미만의 버전에서 인증 우회 취약점을 악용하도록 설계되었습니다. 이 취약점은 시스템에 대한 무단 접근을 허용하며 잠재적으로 악의적인 목적으로 사용될 수 있습니다. 설치: 1. git clone https://github.com/TamingSariMY/CVE-2023-27350-POC.git 2. pip install pyfiglet 사용법: 1. python3 vuln.py 2. IP...

WordPress Simple Job Board - Unauthorized Data Access

The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetchquickjob function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be...

Hunk Companion <= 1.8.4 - Arbitrary Plugin Installation

The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/themehunk-import REST API endpoint in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to...

XWiki Platform - Unauthorized Document History Access

A vulnerability in XWiki Platform's REST API allows unauthorized users to access document history information. The REST API endpoint exposes the history of any page including modification times, version numbers, author details username and display name, and version comments, regardless of access...

Chuanhu Chat - Directory Traversal

The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed to restrict user access to resources within the webassets folder. However, the outdated version of gradio it employs is susceptible to pa...

Argo CD Unauthenticated Access to sensitive setting

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. id: CVE-2024-37152 info: name: Ar...

Flowise < 3.1.2 - node-custom-function Unauthorized RCE

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When...

DATAGERRY - REST API Auth Bypass

Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests. id: CVE-2024-46627 info: name: DATAGERRY - REST API Auth Bypass author: gy741 severity: critical description: | Incorrect access control in BECN DATAGERRY v2.2 allows attackers...

Arcserve Unified Data Protection - Authentication Bypass

An authentication bypass vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in the edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.EdgeLoginServiceImpl.doLogin function within wizardLogin. id: CVE-2024-0799 info: name: Arcserve Unified Data Protection -...

Imgproxy <= 3.14.0 - Server-side request forgery (SSRF)

imgproxy =3.14.0 is vulnerable to Server-Side Request Forgery SSRF due to a lack of sanitization of the imageURL parameter. id: CVE-2023-30019 info: name: Imgproxy = 3.14.0 - Server-side request forgery SSRF author: DhiyaneshDK severity: medium description: | imgproxy =3.14.0 is vulnerable to...

PowerJob <=4.3.2 - Unauthenticated Access

PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface. id: CVE-2023-29923 info: name: PowerJob =4.3.2 - Unauthenticated Access author: For3stCo1d severity: medium description: | PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface. impact: ...

Netgear DGN2200 - Improper Authentication

A vulnerability in the Netgear DGN2200 router with firmware version v1.0.0.46 and earlier permits unauthorized individuals to bypass the authentication. When adding "?x=1.gif" to the requested url, it will be recognized as passing the authentication. id: CVE-2024-57046 info: name: Netgear DGN2200...

Oracle GlassFish Server Open Source Edition 3.0.1 - Local File Inclusion

Oracle GlassFish Server Open Source Edition 3.0.1 build 22 is vulnerable to unauthenticated local file inclusion vulnerabilities that allow remote attackers to request arbitrary files on the server. id: CVE-2017-1000029 info: name: Oracle GlassFish Server Open Source Edition 3.0.1 - Local File...

Horde Groupware Unauthenticated Admin Access

Horde Groupware contains an administrative account with a blank password, which allows remote attackers to gain access. id: CVE-2005-3344 info: name: Horde Groupware Unauthenticated Admin Access author: pikpikcu severity: critical description: Horde Groupware contains an administrative account wi...

Gitea Container Registry - Unauthorized Private Image Access

Gitea = 1.26.2. As a temporary workaround, set REQUIRESIGNINVIEW=true in gitea app.ini, though this blocks all anonymous access including public repos. reference: - https://blog.gitea.com/release-of-1.26.2/ - https://github.com/go-gitea/gitea/pull/37290 -...