CVE-2020-27950

A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update, macOS Catalina 10.15.7 Update. A malicious application may be able to disclose kernel memory.

Github link:
https://github.com/lyonzon2/browser-crash-tool

CVE-2024-6782

None

Github link:
https://github.com/Uno13x/CVE-2024-6782-PoC

CVE-2024-40711

None

Github link:
https://github.com/watchtowrlabs/CVE-2024-40711

CVE-2024-29847

None

Github link:
https://github.com/sinsinology/CVE-2024-29847

CVE-2020-9484

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.

Github link:
https://github.com/0dayCTF/CVE-2020-9484

CVE-2024-8190

None

Github link:
https://github.com/horizon3ai/CVE-2024-8190

CVE-2024-44000

None

Github link:
https://github.com/ifqygazhar/CVE-2024-44000-LiteSpeed-Cache

CVE-2024-32651

changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run any system command without any restriction and they could use a reverse shell. The impact is critical as the attacker can completely takeover the server machine. This can be reduced if changedetection is behind a login page, but this isn't required by the application (not by default and not enforced).

Github link:
https://github.com/s0ck3t-s3c/CVE-2024-32651-changedetection-RCE

CVE-2021-3493

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.

Github link:
https://github.com/fathallah17/OverlayFS-CVE-2021-3493

CVE-2024-5458

None

Github link:
https://github.com/justmexD8/CVE-2024-5458-POC

CVE-2022-25479

None

Github link:
https://github.com/SpiralBL0CK/CVE-2024-40431-CVE-2022-25479-EOP-CHAIN

CVE-2024-43160

None

Github link:
https://github.com/KTN1990/CVE-2024-43160

CVE-2024-7965

None

Github link:
https://github.com/bi-zone/CVE-2024-7965

CVE-2023-52268

None

Github link:
https://github.com/squ1dw3rm/CVE-2023-52268

CVE-2024-3656

None

Github link:
https://github.com/h4x0r-dz/CVE-2024-3656

CVE-2021-40539

Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.

Github link:
https://github.com/lpyydxs/CVE-2021-40539

CVE-2021-40539

Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.

Github link:
https://github.com/lpyzds/CVE-2021-40539

CVE-2020-1938

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to pr

Github link:
https://github.com/s3nd3rjz/poc-CVE-2020-1938

CVE-2023-36845

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series

and SRX Series

allows an unauthenticated, network-based attacker to control certain, important environments variables.

Utilizing a crafted request an attacker is able to modify a certain PHP environment variable leading to partial loss of integrity, which may allow chaining to other vulnerabilities.


This issue affects Juniper Networks Junos OS on SRX Series:



* All versions prior to 21.4R3-S5;
* 22.1 versions

prior to

22.1R3-S4;
* 22.2 versions

prior to

22.2R3-S2;
* 22.3 versions

prior to

22.3R2-S2, 22.3R3-S1;
* 22.4 versions

prior to

22.4R2-S1, 22.4R3;
* 23.2 versions prior to 23.2R1-S1, 23.2R2.






Github link:
https://github.com/functionofpwnosec/CVE-2023-36845

CVE-2024-9570

None

Github link:
https://github.com/dylvie/CVE-2024-9570_D-Link-DIR-619L-bof