CVE-2024-21413

Microsoft Outlook Remote Code Execution Vulnerability

Github link:
https://github.com/DerZiad/CVE-2024-21413

CVE-2024-29972

None

Github link:
https://github.com/Pommaq/CVE-2024-29972-CVE-2024-29976-CVE-2024-29973-CVE-2024-29975-CVE-2024-29974-poc

CVE-2024-34102

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

Github link:
https://github.com/0x0d3ad/CVE-2024-34102

CVE-2024-34102

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

Github link:
https://github.com/11whoami99/CVE-2024-34102

CVE-2024-5961

None

Github link:
https://github.com/kac89/CVE-2024-5961

CVE-2024-6387

None

Github link:
https://github.com/zgzhang/cve-2024-6387-poc

CVE-2019-18818

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.

Github link:
https://github.com/Hackhoven/Strapi-RCE

CVE-2024-20666

BitLocker Security Feature Bypass Vulnerability

Github link:
https://github.com/invaderslabs/CVE-2024-20666

CVE-2024-34102

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

Github link:
https://github.com/jakabakos/CVE-2024-34102-CosmicSting-XXE-in-Adobe-Commerce-and-Magento

CVE-2021-4034

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

Github link:
https://github.com/evkl1d/CVE-2021-4034

CVE-2024-6387

None

Github link:
https://github.com/TrustResearcher/CVE-2024-6387-Updated-SSH-RCE

CVE-2024-6050

None

Github link:
https://github.com/kac89/CVE-2024-6050

CVE-2019-6111

An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).

Github link:
https://github.com/mbadanoiu/MAL-008

CVE-2024-6387

None

Github link:
https://github.com/FerasAlrimali/CVE-2024-6387-POC

CVE-2024-6387

None

Github link:
https://github.com/lflare/cve-2024-6387-poc

CVE-2024-6387

None

Github link:
https://github.com/acrono/cve-2024-6387-poc

CVE-2024-28995

SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.

Github link:
https://github.com/Stuub/CVE-2024-28995

CVE-2024-38366

None

Github link:
https://github.com/ReeFSpeK/CocoaPods-RCE

CVE-2024-29269

An issue discovered in Telesquare TLR-2005Ksh 1.0.0 and 1.1.4 allows attackers to run arbitrary system commands via the Cmd parameter.

Github link:
https://github.com/K3ysTr0K3R/CVE-2024-29269-EXPLOIT

CVE-2024-6387

A signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog().

Github link:
https://github.com/wiggels/regresshion-check