CVE-2020-14882

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Github link:
https://github.com/KKC73/weblogic-cve-2020-14882

CVE-2024-40094

None

Github link:
https://github.com/inpentest/CVE-2024-40094

CVE-2024-57727

None

Github link:
https://github.com/imjdl/CVE-2024-57727

CVE-2022-34169

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.

Github link:
https://github.com/Disnaming/CVE-2022-34169

CVE-2024-52380

None

Github link:
https://github.com/Nxploited/CVE-2024-52380-Exploit

CVE-2024-54369

None

Github link:
https://github.com/Nxploited/CVE-2024-54369-PoC

CVE-2023-44487

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Github link:
https://github.com/aulauniversal/CVE-2023-44487

CVE-2024-13375

None

Github link:
https://github.com/McTavishSue/CVE-2024-13375

CVE-2024-9474

None

Github link:
https://github.com/aratane/CVE-2024-9474

CVE-2022-40684

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

Github link:
https://github.com/AKboss1221/fortigate-belsen-leak

CVE-2024-55591

None

Github link:
https://github.com/souzatyler/fortios-auth-bypass-check-CVE-2024-55591

CVE-2024-54795

None

Github link:
https://github.com/MarioTesoro/CVE-2024-54795

CVE-2024-54792

None

Github link:
https://github.com/MarioTesoro/CVE-2024-54792

CVE-2024-54794

None

Github link:
https://github.com/MarioTesoro/CVE-2024-54794

CVE-2025-22620

None

Github link:
https://github.com/EliahKagan/checkout-index

CVE-2024-55504

None

Github link:
https://github.com/SyFi/CVE-2024-55504

CVE-2023-46805

An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.

Github link:
https://github.com/Hexastrike/Ivanti-Secure-Connect-Logs-Parser

CVE-2024-57523

None

Github link:
https://github.com/HackWidMaddy/CVE-2024-57523.

CVE-2024-6387

A signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog().

Github link:
https://github.com/AzrDll/CVE-2024-6387

CVE-2021-44228

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Github link:
https://github.com/ZacharyZcR/CVE-2021-44228