PR-DNSd

PR-DNSd パッシブ・リカーシブDNSデーモン。 何をするものか クイックスタート root@kitploit: go get github.com/korc/PR-DNSd sudo setcap capnetbindservice,capsyschroot=ep go/bin/PR-DNSd go/bin/PR-DNSd -upstream 9.9.9.9:53 -listen 127.0.0.1:53 echo nameserver 127.0.0.1 | sudo tee /etc/resolv.conf dig google.com dig -x $dig +short...

wssip

This repository does not have a README...

nginx: NGINX: Heap buffer over-read allows memory modification or denial of service

A vulnerability in NGINX's ngxhttpssimodule allows an unauthenticated MITM attacker to trigger a heap buffer over-read by manipulating upstream server responses. This requires SSI, proxypass, and proxybuffering off to be configured, and can result in memory modification or a Denial of Service DoS...

Linux---Security---Detect-and-Mitigate-CVE-2024-3094

Linux - Seguridad - Detectar y Mitigar CVE-2024-3094 Se determinó que se descubrió código malicioso en los tarballs upstream de xz, a partir de la versión 5.6.0. Se determinó que solo ciertos sistemas operativos y versiones de sistemas operativos se vieron afectados por esta vulnerabilidad. Este...

bash-cve-2014-6271-fixes

CVE-2014-6271 的 bash 补丁 最初的邮件列表帖子只允许你通过未认证的 HTTP 获取补丁。 唉 我已通过 HTTP 下载了这些文件，并将它们放入一个 git 仓库中，你可以通过 HTTPS 获取并独立核验。 我尚未核验这些文件是否真实，但你可以独立检查自己拥有的文件是否相同。 原始公告 SHA256SUMS == 上游补丁 == 从 http://ftp.gnu.org/pub/gnu/bash/bach--patches/ 获取 upstream/bash30-017 upstream/bash31-018 upstream/bash32-052...

ollama

ollama 此仓库是 Endor Labs EXPOSURE 的合成演示目标 。 当前状态刻意设计为易受攻击 （热状态）。EXPOSURE 将针对其报告热（HOT）判定。 跟踪的 CVE: CVE-2024-12886（无上游修复；仅通过补偿控制缓解）。 EXPOSURE 打开的演示 PR 将规范配置文件替换为加固变体，从而破坏攻击链—— 无需 升级易受攻击的依赖。 客户应用修复的工作量为一键完成 （审查 + 合并）。 此仓库非生产应用程序。它仅用于锚定 EXPOSURE“点击 → 实际 PR 打开”演示，针对真实 GitHub 仓库。...

node-prompt-here

node-prompt-here Este repositorio es un objetivo de demostración sintético para Endor Labs EXPOSURE. El estado actual es deliberadamente vulnerable HOT. EXPOSURE reportará un veredicto de HOT en su contra. CVE rastreado: CVE-2020-7602 sin parche oficial; mitigado solo mediante un control...

invokeai

invokeai 这是一个用于 Endor Labs EXPOSURE 的 合成演示目标 。 当前状态是 故意存在漏洞的 （HOT）。EXPOSURE 将报告一个 HOT 结论。 跟踪的 CVE：CVE-2024-10821（没有上游修复；仅通过补偿控制缓解）。 EXPOSURE 打开的一个演示 PR 会将规范配置文件替换为强化变体，从而打破漏洞利用链—— 无需 升级易受攻击的依赖项。 客户应用修复的工作量是 一次点击 （审核 + 合并）。 此仓库不是生产应用程序。它仅用于锚定 EXPOSURE “点击 → 打开真实 PR” 演示针对一个真实 GitHub 仓库。...

Updated kernel-linus packages fix security vulnerabilities

Vanilla upstream kernel version 6.18.44 fixes vulnerabilities. For information about the vulnerabilities see the links...

proxify

...

CVE-2026-75922

Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATHINFO written unencoded to the upstream request line. PSGI hands PATHINFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it...

CVE-2026-75922 Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line

Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATHINFO written unencoded to the upstream request line. PSGI hands PATHINFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it...

EUVD-2026-64662

Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATHINFO written unencoded to the upstream request line. PSGI hands PATHINFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it...

cve-2024-3094

🛡️ 网络安全项目：分析 liblzma 中的 XZ 后门 📄 概述 本项目分析了在 xz-utils liblzma 中发现的高度隐蔽后门，影响版本 5.6.0 和 5.6.1 。引入上游构建系统的恶意代码通过修改 sshd 在运行时与 LZMA 压缩库的交互方式，针对 SSH 认证进行攻击。 ⚠️ 本项目仅用于教育和防御性研究 目的。 受害机器 克隆此仓库 root@kitploit: git clone https://github.com/valeriot30/cve-2024-3094 进入目录 root@kitploit: cd cve-2024-3094 启动 docker...

CVE-2026-42926

A flaw was found in NGINX Open Source. When NGINX is configured to proxy HTTP/2 traffic and uses proxysetbody, a remote attacker may be able to inject malicious data into the upstream peer. This could lead to unintended data manipulation or bypass of security controls. Mitigation To mitigate this...

reactor

Reactor Reactor 最初是开源项目 ElastAlert 的一个分支。本项目维护者应密切关注 ElastAlert 的变更（不包括其额外的告警器），并确保任何相关的错误修复被合入、任何有用的功能被移植进来。 Reactor 是一个告警引擎，它接收一组带有自定义过滤器的规则，并在匹配时发出告警。Reactor 会自动用重复告警信息更新已静默的告警。 来自 ElastAlert 的补丁历史 访问日期| Commit| 备注 ---|---|--- 2019-10-16| 325f1dfe7a45f3ca2a2cc00127ab71fcd4f9cead| 回溯到 Reactor...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation through TransportSocketSnapshot in xds/src/main/java/com/linecorp/armeria/xds/TransportSocketSnapshot.java. An attacker can perform a man-in-the-middle attack against an xDS-managed upstream connection by...

CVE-2026-11751

A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections...

CVE-2026-11751

The armeria-xds library (versions prior to 1.41.0 ) silently disables TLS peer verification for xDS-managed upstream connections, enabling man-in-the-middle attacks with network-level access. CVSS 4.0 scores this CRITICAL (9.1). Exploitation details are not provided; upgrade to armeria-xds 1.41.0...

PT-2026-78255

Name of the Vulnerable Software and Affected Versions armeria-xds versions prior to 1.41.0 Description An issue exists where xDS upstream TLS peer verification may be silently disabled. This allows man-in-the-middle attacks against upstream connections managed by xDS. TLS Transport Layer Security...