CVE-2024-6387
A signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog().
Github link:
https://github.com/xiw1ll/CVE-2024-6387_Checker
A signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog().
Github link:
https://github.com/xiw1ll/CVE-2024-6387_Checker
GitHub
GitHub - xiw1ll/CVE-2024-6387_Checker: Nuclei template to detect CVE-2024-6387. All latest patched versions are excluded.
Nuclei template to detect CVE-2024-6387. All latest patched versions are excluded. - xiw1ll/CVE-2024-6387_Checker
CVE-2021-45046
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
Github link:
https://github.com/ifconfig-me/Log4Shell-Payloads
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
Github link:
https://github.com/ifconfig-me/Log4Shell-Payloads
GitHub
GitHub - ifconfig-me/Log4Shell-Payloads: Log4Shell / Log4J Payload - CVE-2021-45046 and CVE-2022-42889
Log4Shell / Log4J Payload - CVE-2021-45046 and CVE-2022-42889 - ifconfig-me/Log4Shell-Payloads
CVE-2017-12637
None
Github link:
https://github.com/abrewer251/CVE-2017-12637_SAP-NetWeaver-URL-Traversal
None
Github link:
https://github.com/abrewer251/CVE-2017-12637_SAP-NetWeaver-URL-Traversal
GitHub
GitHub - abrewer251/CVE-2017-12637_SAP-NetWeaver-URL-Traversal: Proof-of-concept LFI Scanner: Automated detection of /etc/passwd…
Proof-of-concept LFI Scanner: Automated detection of /etc/passwd exposures via directory traversal and regex matching. - abrewer251/CVE-2017-12637_SAP-NetWeaver-URL-Traversal
CVE-2022-46689
A race condition was addressed with additional validation. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. An app may be able to execute arbitrary code with kernel privileges.
Github link:
https://github.com/LumberjackStorys/CVE
A race condition was addressed with additional validation. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. An app may be able to execute arbitrary code with kernel privileges.
Github link:
https://github.com/LumberjackStorys/CVE
GitHub
LumberjackStorys/CVE
Proof-of-concept app to overwrite fonts on iOS using CVE-2022-46689. - LumberjackStorys/CVE
CVE-2024-23346
Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.20. This method insecurely utilizes `eval()` for processing input, enabling execution of arbitrary code when parsing untrusted input. Version 2024.2.20 fixes this issue.
Github link:
https://github.com/DAVIDAROCA27/CVE-2024-23346-exploit
Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.20. This method insecurely utilizes `eval()` for processing input, enabling execution of arbitrary code when parsing untrusted input. Version 2024.2.20 fixes this issue.
Github link:
https://github.com/DAVIDAROCA27/CVE-2024-23346-exploit
GitHub
GitHub - DAVIDAROCA27/CVE-2024-23346-exploit: This is a exploit for the known Remote Code Execution (RCE) vulnerability in the…
This is a exploit for the known Remote Code Execution (RCE) vulnerability in the `pymatgen` (CVE-2024-23346) Python library by uploading a malicious `CIF` file to the hosted `CIF Analyzer` website ...
CVE-2025-1302
Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode.**Note:**This is caused by an incomplete fix for [CVE-2024-21534](https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884).
Github link:
https://github.com/abrewer251/CVE-2025-1302_jsonpath-plus_RCE
Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode.**Note:**This is caused by an incomplete fix for [CVE-2024-21534](https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884).
Github link:
https://github.com/abrewer251/CVE-2025-1302_jsonpath-plus_RCE
Learn more about npm with Snyk Open Source Vulnerability Database
Remote Code Execution (RCE) in jsonpath-plus | CVE-2024-21534 | Snyk
Critical severity (9.3) Remote Code Execution (RCE) in jsonpath-plus | CVE-2024-21534
CVE-2021-1675
Windows Print Spooler Elevation of Privilege Vulnerability
Github link:
https://github.com/CameraShutterBug/PrintNightmare
Windows Print Spooler Elevation of Privilege Vulnerability
Github link:
https://github.com/CameraShutterBug/PrintNightmare
GitHub
CameraShutterBug/PrintNightmare
C# and Impacket implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527 - CameraShutterBug/PrintNightmare