1322 matches found
CVE-2021-34473-Exchange-ProxyShell
python sendwebshellmail.py https://mail16.echod.com [email protected] Single retrieval python sendwebshellmail.py https://mail16.echod.com crack Batch read emails from mail.txt and attempt to obtain SID tokens python sendwebshellmail.py https://mail16.echod.com [email protected] send on...
CVE-2018-12463
CVE-2018-12463 Vulnerabilidad de entidad externa XML XXE en /ssc/fm-ws/services en Fortify Software Security Center SSC 17.10, 17.20 y 18.10 permite a usuarios remotos no autenticados leer archivos arbitrarios o realizar ataques de falsificación de solicitudes del lado del servidor SSRF mediante ...
CVE-2019-2890
Declaración Solo para fines de aprendizaje e intercambio, otros usos son bajo su propia responsabilidad. Descripción Los archivos jar relevantes ya se han importado al proyecto, y el método de explotación utiliza JRMP de yso. Durante el aprendizaje y la depuración, se puede modificar el método de...
sharepoint-2026-poc
SharePoint /trust WS-Federation Deserialization: PoC y notas de detección Informe en vivo GitHub Pages: https://sp-poc.wismansec.com/ renderizado HTML de este documento. Afecta: SharePoint Server 2016, 2019 y Subscription Edition. Reconstrucción de una intrusión en SharePoint Server Subscription...
Microsoft SharePoint Server - WS-Federation BinaryFormatter Deserialization RCE
Microsoft SharePoint Server 2016, 2019, Subscription Edition = 2026.3.1 contains a remote code execution vulnerability in the WS-Federation passive sign-in endpoint /trust/default.aspx. The SharePoint authentication module SPFederationAuthenticationModuleV2 uses a deflate-only...
WS-Attacker
WS-Attacker WS-Attacker es un marco modular para pruebas de penetración de servicios web. Es desarrollado por la Cátedra de Seguridad de Redes y Datos, Universidad Ruhr Bochum https://nds.rub.de/ y Hackmanit GmbH https://hackmanit.de/. La idea básica detrás de WS-Attacker es proporcionar una...
CVE-2023-6246
已在默认的 Fedora WS 38 上测试通过...
asf__cxf_CVE-2016-6812_3-0-11
¡Bienvenido a Apache CXF! Apache CXF es un framework de servicios de código abierto. CXF te ayuda a construir y desarrollar servicios utilizando APIs de programación frontend, como JAX-WS y JAX-RS. Estos servicios pueden hablar una variedad de protocolos como SOAP, XML/HTTP, HTTP RESTful o CORBA ...
CVE-2026-79395
An improper authentication vulnerability in the WS-Security wsse:UsernameToken verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote attackers to bypass authentication and execute privileged ONVIF actions including...
ROOT-APP-NPM-CVE-2021-32640 CVE-2021-32640 in ws - Patched by Root
Root has patched CVE-2021-32640 in the ws package for Root:npm. Multiple fixed versions available...
EUVD-2026-76192
An improper authentication vulnerability in the WS-Security wsse:UsernameToken verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote attackers to bypass authentication and execute privileged ONVIF actions including...
CVE-2026-79395
An improper authentication vulnerability in the WS-Security wsse:UsernameToken verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote attackers to bypass authentication and execute privileged ONVIF actions including...
EUVD-2026-76185
A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary cod...
CVE-2026-79395
CVE-2026-79395 is a CRITICAL (CVSS 9.8) improper authentication flaw in the Sofia IPC daemon of the Xiongmai IP Camera XM530 (firmware HMT.CM2005-v220608.1837 and earlier). The vulnerability resides in the WS-Security (wsse:UsernameToken) verification routine: when the admin account's stored pass...
ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments
A flaw was found in ws, an open source WebSocket client and server. A remote attacker can exploit this memory exhaustion vulnerability by sending a high volume of exceptionally small fragments and data chunks. This action forces the affected component to allocate and hold structural wrappers that...
ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`
A flaw was found in ws, an open source WebSocket client and server for Node.js. The websocket.close implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This can lead to the disclosure of sensitive information from uninitialized memor...
ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments
A flaw was found in ws, an open source WebSocket client and server. A remote attacker can exploit this memory exhaustion vulnerability by sending a high volume of exceptionally small fragments and data chunks. This action forces the affected component to allocate and hold structural wrappers that...
ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`
A flaw was found in ws, an open source WebSocket client and server for Node.js. The websocket.close implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This can lead to the disclosure of sensitive information from uninitialized memor...
CVE-2026-88287
GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and crash the discovery process...