serviceDetector

serviceDetector 로컬 관리자 권한을 사용하지 않고 원격 머신에서 서비스가 설치되어 있는지맹목적으로 및/또는 실행 중인지명명된 파이프를 노출하는 경우 탐지합니다. About 자세히 설명하면, 이 스크립트를 실행하면 대상 SMB 서비스445/tcp에 원격으로 연결하여 다음 작업을 수행합니다: 1. MS-LSAT RPC 호출 LsarLookupNames을 통해 지정된 서비스가 설치되어 있는지 확인합니다. 권한 있는 계정을 사용할 필요는 없지만 "맹목적" 쿼리만 가능합니다서비스 목록을 나열할 수 없고 특정 서비스의 상태만...

CVE-2026-74237

GFI Exinda AI versions before 7.6.5 contain an argument injection vulnerability in the Tools Iperf Client functionality. The web_tools_cmd() function constructs an iperf command from user-supplied server and options parameters without sanitization, allowing injection of arbitrary iperf flags. An ...

cve-2024-31317

CVE-2024-31317 탐구 CVE-2024-31317은 일반 Android 앱이 사용 가능한 모든 uid 및 SELinux 범위에 대한 권한 없는 접근을 제공합니다. 이를 통해 uid 1000system 및 uid 2000shell에 접근할 수 있으며, 권한이 없는 앱에서 전적으로 트리거될 수 있어 이를 사용하는 모든 기능의 지속성을 가능하게 합니다. 설명 SELinux 모방 Zygote 인자 에뮬레이터 설정 이용 가능성 이 익스플로잇은 2024년 6월 보안 패치 이전의 대부분 Android 버전과 Android 9+에...

secpub

Cisco Nexus OS NX-OS - 명령어 "인젝션" / 입력 값 정화 문제. 발견자: Peter Adkins [email protected] 접근 권한: 로컬; 인증된 접근이 필요합니다. 추적 및 식별자: CVE - CVE-2011-2569 영향을 받는 OS: Cisco Nexus OS NX-OS 벤더 협력: 통보됨 - 일부 플랫폼에 패치 제공 / 구현됨. 영향을 받는 시스템 / 플랫폼: Nexus 7000 Nexus 5000 Nexus 4000 Nexus 3000 Nexus 2000 Nexus 1000V MD...

GeoServer Demo Request Endpoint - Server Side Request Forgery

It is possible to achieve Server Side Request Forgery SSRF via the Demo request endpoint if Proxy Base URL has not been set. An unauthenticated user can supply a request that will be issued by the server, allowing enumeration of internal networks and, in the case of cloud instances, access to...

Vulnerable-Docker-Engine

CVE-2021-41091 Этот эксплойт предлагает подробный анализ уязвимости CVE-2021-41091 и содержит пошаговое руководство по использованию скрипта эксплойта для повышения привилегий на хосте. Сводка уязвимости CVE-2021-41091 — это ошибка в Moby Docker Engine, которая позволяет непривилегированным...

CVE-2023-2002

Linux Bluetooth: 관리 명령 무단 실행 CVE-2023-2002 Linux 커널의 Bluetooth 서브시스템에서 HCI 소켓의 ioctl 시스템 호출을 처리할 때 불충분한 권한 검사가 발견되었습니다. 이로 인해 필요한 CAPNETADMIN capability가 없는 태스크도 HCI 소켓을 쉽게 trusted신뢰됨로 표시할 수 있습니다. trusted 소켓은 새 기기와의 페어링 또는 연결과 같은 관리 명령 및 이벤트의 송수신을 가능하게 하기 위한 것입니다. 그 결과, 권한이 없는 사용자가 trusted 소켓을 획득...

CVE-2023-42791_CVE-2024-23666

Эксплойт-скрипты для FortiManager: недостаточные проверки авторизации CVE-2024-23666 и неограниченная загрузка файлов CVE-2023-42791 Предоставлены два эксплойт-скрипта, использующих эти уязвимости: rce.py: Обеспечивает обратную оболочку или добавляет произвольного администратора из...

CVE-2022-1972-infoleak-PoC

CVE-2022-1972 infoleak PoC Эксплойт infoleak для CVE-2022-1972. Вы можете найти соответствующий разбор в нашем блоге Требования Пространства имен пользователей должны быть доступны для непривилегированных пользователей. root@kitploit: $ sysctl kernel.unprivilegedusernsclone...

CVE-2026-28867-PoC

CVE-2026-28867 Как это работает Уязвимость существует из-за того, что реализация ядра tcpsysctlinfo выполняет глобальный поиск соединения без проверки того, что вызывающий процесс владеет сокетом или обладает повышенными привилегиями, такими как root. Воздействие Непривилегированный злоумышленник...

CVE-2022-0847

CVE-2022-0847 리눅스 “Dirty Pipe” 취약점으로 권한 없는 사용자가 루트 접근 권한을 얻음...

Astra Linux – Vulnerability in Containerd

Containerd is an open-source container runtime that emphasizes simplicity, robustness, and portability. A bug was discovered in Containerd where container root directories and certain plugins had insufficiently restricted permissions, allowing unprivileged Linux users to access the contents of...

UBUNTU-CVE-2026-74640

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: fix OOB write in fcpmeterctlget fcpioctlsetmetermap bounds the user-supplied Level Meter map size by the driver's own limit of 255 if map.mapsize 255 || map.meterslots 255 return -EINVAL; and passes it to fcpaddnewctl ...

EUVD-2026-64552

In the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down vxlanchangelink arms vxlan-agetimer whenever the requested ageing interval differs from the configured one: if conf.ageinterval != vxlan-cfg.ageinterval...

CVE-2026-49431

CVE-2026-49431 is an access control flaw in the OpenZFS component of FreeBSD (all supported versions). The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user, allowing any unprivileged local user to set the internal ZFS metadata flag $hasrecvd on a dataset, falsely...

CVE-2026-72117

A flaw was found in the Linux kernel's CAN Controller Area Network Broadcast Manager BCM module. A data race condition exists in the bcmrxhandler function where the rxstamp and rxifindex values are written without proper locking. This can lead to a "torn store" of the 64-bit rxstamp on 32-bit...

CVE-2026-72049

A flaw was found in the Linux kernel's IEEE 802.15.4 LLSEC subsystem. A local user without special privileges could exploit ungated legacy dump operations to read raw 16-byte AES-128 keys from the kernel keytable on wireless personal area network WPAN devices. This information disclosure...

kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges

A flaw was found in the Linux kernel in net/can/bcm.c in can: bcm, where an unprivileged local user can exploit this vulnerability to execute arbitrary code within the kernel, which leads to a local privilege escalation LPE. This allows the attacker to gain root privileges and take full control o...

The vulnerability in the driver/media/PCI/CX25821/CX25821-core.c component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the drivers/media/pci/cx25821/cx25821-core.c component in the Linux operating system is related to improper memory release before removing the last reference. Exploiting this vulnerability can allow an attacker to cause a service failure...

SUSE CVE-2026-74503

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Clear SNDRVTIMERIFLGDEAD once the close completes sndtimercloselocked marks an instance with SNDRVTIMERIFLGDEAD and returns early when the flag is already set, but the flag is never cleared again. A completed close...