Linux 4.2 Out-Of-Bounds Write

The USB CDC-ACM driver in Linux versions starting at 4.12 suffers from a missing size check in acmctrlirq that leads to an out-of-bounds write...

WordPress RepairBuddy 3.8115 Shell Upload

WordPress RepairBuddy plugin versions 3.8115 and below suffer from a remote shell upload vulnerability...

WordPress Pubnews 1.0.7 Arbitrary Plugin Installation

WordPress Pubnews theme versions 1.0.7 and below suffer from an unauthenticated arbitrary plugin installation vulnerability...

GNUnet P2P Framework 0.24.0

GNUnet is a peer-to-peer framework with focus on providing security. All peer-to-peer messages in the network are confidential and authenticated. The framework provides a transport abstraction layer and can currently encapsulate the network traffic in UDP IPv4 and IPv6, TCP IPv4 and IPv6, HTTP, o...

WordPress Portfolleo 1.2 Shell Upload

WordPress Portfolleo plugin versions 1.2 and below suffer from a remote shell upload vulnerability...

Next.js Middleware Authorization Bypass

Proof of concept exploit that demonstrates an authorization bypass being exploited in Next.js middleware...

msm_npu Race Condition / Memory Corruption

msmnpu has a race condition between npuhostunloadnetwork and npuhostexecnetworkv2 that leads to memory corruption...

Creating Scripts to Identify Vulnerable Firewalls

This whitepaper covers how to create Nmap scripts to identify banners and versions of firewalls. Written in Portuguese...

How to Create a Scan in Perl to Identify Vulnerable FTP Servers

This whitepaper covers how to create a perl script to identify vulnerable versions of FTP servers via their banners. Mitigations are also provided. Written in Portuguese...

ImageMagick 7.1.1-35 Arbitrary Code Execution

ImageMagick versions 7.1.1-35 and below proof of concept exploit allowing arbitrary code execution via malicious XML delegation...

WordPress WPMasterToolKit 1.13.1 Shell Upload

WordPress WPMasterToolKit plugin versions 1.13.1 and below remote shell upload exploit...

WordPress Exclusive Content Password Protect 1.1.0 Shell Upload

WordPress Exclusive Content Password Protect plugin versions 1.1.0 and below remote shell upload exploit...

libxslt xsltEvalXPathStringNs Use-After-Free

There is a use-after-free issue in libxslt that could be used to leak information and potentially execute arbitrary code...

Gibbon 25.0.0 Local File Inclusion

Gibbon version 25.0.0 local file inclusion exploit that downloads a SQL dump...

Akira Ransomware Bruteforcer

This tool helps decrypt encrypted files from Akira Ransomware Linux/ESXI variant 2024 using a bunch of GPUs...

TP-Link TL-WR845N Hardcoded Credentials

Proof of concept exploit that checks if your TP-Link TL-WR845N router suffers from a hardcoded credential vulnerability...

Creating Scripts to Identify Vulnerable HTTP Webservers

This whitepaper covers how to create Nmap scripts to identify banners and versions of webservers. It also covers methods to mitigate the public visibility of banners and version information on webservers. Written in Portuguese...

Linux LSM POSIX Lock Use-After-Free

An LSM can prevent the fcntl/close race cleanup path in fcntlsetlk from working, leading to use-after-free read in lockgetstatus when reading /proc/locks...

Linux 6.4 VMA Use-After-Free / Race Condition

Linux 6.4 suffers from a use-after-free condition when per-VMA locks introduce a race between page fault and MREMAPDONTUNMAP...

adsprpc Refcount Leak / Use-After-Free

adsprpc suffers from a refcount leak that leads to a use-after-free condition in fastrpcgetprocessgids...

Linux ax88179_rx_fixup() Out-Of-Bounds Access

drivers/net/usb/ax88179178a.c contains multiple out-of-bounds accesses in ax88179rxfixup, the function responsible for taking a buffer received over USB and splitting it up into ethernet packets...

Creating Scripts to Identify Vulnerable Oracle Servers

This whitepaper covers how to create Nmap scripts to identify banners and versions of Oracle servers. It also covers methods to mitigate the public visibility of banners and version information on Oracle servers. Written in Portuguese...

Linux 4.10 __do_semtimedop() Use-After-Free

Linux versions from 4.10 suffers from a use-after-free condition in dosemtimedop due to a lockless check outside RCU section...

PowerVR DEVMEMXINT_RESERVATION::ppsPMR Lock Failure

The array ppsPMR in DEVMEMXINTRESERVATION holds references to PMR structures using PMRRefPMR2, intending to prevent the PMRs' physical memory from being released. However, PMRs with PVRSRVMEMALLOCFLAGNOOSPAGESONALLOC which for OSMem PMRs internally translates to FLAGONDEMAND can release their...

Creating Scripts to Identify Vulnerable Proxy Servers

This whitepaper covers how to create Nmap scripts to identify banners and versions of proxy servers. It also covers methods to mitigate the public visibility of banners and version information on proxy servers. Written in Portuguese...

Linux FUSE Use-After-Free

FUSE in Linux allows use-after reads of write buffers, allowing theft of partial /etc/shadow hashes...

Linux munmap() Race Condition / Use-After-Free

Linux munmap has a race condition with pagemapread that leads to a page use-after-free condition...

Linux DCCP Binary Information Leak

Linux suffers from a small remote binary information leak in DCCP that requires a victim's machine to have established connections...

Linux 3.19 anon_vma Use-After-Free

Linux 3.19 suffers from a use-after-free vulnerability via anonvma...

PowerVR DevmemIntChangeSparse2() Use-After-Free

PowerVR suffers from a DevmemIntChangeSparse2 use-after-free condition on a PMRGetUID call...

Creating Scripts to Identify Vulnerable Telnet Services

This whitepaper covers how to create Nmap scripts to identify banners and versions of Telnet servers. It also covers methods to mitigate the public visibility of banners and version information on Telnet servers. Written in Portuguese...

Creating Scripts to Identify Vulnerable POP Servers

This whitepaper covers how to create Nmap scripts to identify banners and versions of POP servers. It also covers methods to mitigate the public visibility of banners and version information on POP servers. Written in Portuguese...

Linux Stale TLB Use-After-Free

Linux stable versions 5.4 and 5.10 suffer from a page use-after-free condition via a stale TLB entry caused by rmap lock not being held during PUD move...

Linux 6.5 Kernel Pointer Leak

The Linux cachestat syscall introduced in 6.5 has a read-after-type-change of folio that leads to a kernel pointer leak...

Linux FUSE Uninitialized Memory Read

FUSE on Linux has an issue where a page is marked uptodate while actually containing uninitialized data beyond EOF, so uninitialized memory can be read via mmap on systems without init-on-alloc...

Apache Tomcat Remote Code Execution

Apache Tomcat proof of concept remote code execution exploit that affects versions 11.0.0-M1 through 11.0.2, 10.1.0-M1 through 10.1.34, and 9.0.0.M1 through 9.0.98...

Linux 4.20 ktls Write Issue

When splice is called with a ktls socket as destination, the ktls code fails to update the internal "curr"/"copybreak" accounting that tracks which parts of the plaintext scatter-gather buffer struct skmsgsg are unused writable memory. This can cause subsequent writes to the socket to overwrite t...

Creating Scripts to Identify Vulnerable SMTP Servers

This whitepaper covers how to create Nmap scripts to identify banners and versions of SMTP servers. It also covers methods to mitigate the public visibility of banners and version information on SMTP servers. Written in Portuguese...

Penetration Testing Steps and Tools

This whitepaper goes over reconnaissance of a target, various types of attacks leveraged during penetration testing, and provides examples of the commands used in the process...

WordPress Elementor Pro Animation Addon 1.6 Missing Authorization

The Animation Addons for Elementor Pro plugin versions 1.6 and below on WordPress suffers from a missing capability check allowing for arbitrary plugin installation...

WordPress Finale Lite 2.18.0 Missing Authorization

WordPress Finale Lite plugin versions 2.18.0 and below missing authorization proof of concept exploit that allows an attacker to install and activate arbitrary plugins...

WordPress Th Shop Mania Theme 1.4.9 Missing Authorization

WordPress Th Shop Mania theme versions 1.4.9 and below missing capability check proof of concept exploit allowing for arbitrary plugin installation...

Creating Scripts to Identify Vulnerable SSH Servers

This whitepaper covers how to create Nmap scripts to identify banners and versions of SSH servers. It also covers methods to mitigate the public visibility of banners and version information on SSH servers. Written in Portuguese...

WordPress NextMove Lite 2.17.0 Missing Authorization

WordPress NextMove Lite plugin version 2.17.0 missing authorization proof of concept exploit that allows an attacker to install and activate arbitrary plugins...

WordPress ThemeEgg ToolKit 1.2.9 Shell Upload

WordPress ThemeEgg ToolKit plugin versions 1.2.9 and below suffer from a remote shell upload vulnerability...

WordPress WooCommerce 2.4.1 Arbitrary File Upload

This exploit leverages an unauthorized limited arbitrary file upload vulnerability in the Order Attachments for WooCommerce plugin versions 2.0 to 2.4.1 for WordPress. The vulnerability allows authenticated users Subscriber+ to upload restricted file types without proper authorization...

Pexels Free Stock Photos 1.2.2 Shell Upload

Pexels Free Stock Photos versions 1.2.2 and below suffer from a remote shell upload vulnerability...

WordPress Top Store Theme 1.5.4 Privilege Escalation

This script exploits CVE-2024-10673, a critical vulnerability found in the Top Store WordPress Theme versions 1.5.4 and below. The flaw allows authenticated users with subscriber-level access or higher to install and activate arbitrary plugins via unprotected AJAX requests. This can lead to...

Creating Scripts to Identify Vulnerable FTPs

This whitepaper covers how to create Nmap scripts to identify banners and versions of FTP servers. It also covers methods to mitigate the public visibility of banners and version information on FTP servers. Written in Portuguese...

A Practical Memory Injection Attack against LLM Agents

In this whitepaper, the authors propose a novel Memory INJection Attack, MINJA, that enables the injection of malicious records into the memory bank by only interacting with the agent via queries and output observations...