CVE-2024-6387

A signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog().

Github link:
https://github.com/niktoproject/CVE-202406387_Check.py

CVE-2024-0741

None

Github link:
https://github.com/HyHy100/Firefox-CVE-2024-0741

CVE-2024-27198

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

Github link:
https://github.com/Pypi-Project/RCity-CVE-2024-27198

CVE-2020-0796

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.

Github link:
https://github.com/z3ena/Exploiting-and-Mitigating-CVE-2020-0796-SMBGhost-and-Print-Spooler-Vulnerabilities

CVE-2023-27216

None

Github link:
https://github.com/HoangREALER/CVE-2023-27216

CVE-2024-37085

None

Github link:
https://github.com/WTN-arny/Vmware-ESXI

CVE-2020-6308

SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure and gather information for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to perform malicious requests, resulting in a Server-Side Request Forgery vulnerability.

Github link:
https://github.com/MachadoOtto/sap_bo_launchpad-ssrf-timing_attack

CVE-2022-31814

pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected.

Github link:
https://github.com/ArunHAtter/CVE-2022-31814

CVE-2022-38725

None

Github link:
https://github.com/wdahlenburg/CVE-2022-38725

CVE-2024-56662

None

Github link:
https://github.com/nimosec/cve-2024-56662

CVE-2024-34102

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

Github link:
https://github.com/EQSTSeminar/CVE-2024-34102

CVE-2024-43044

None

Github link:
https://github.com/v9d0g/CVE-2024-43044-POC

CVE-2024-36424

None

Github link:
https://github.com/secunnix/CVE-2024-36424

CVE-2024-0044

In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.



Github link:
https://github.com/nahid0x1/CVE-2024-0044

CVE-2024-1931

None

Github link:
https://github.com/passer12/CVE-2024-1931-reproduction

CVE-2012-1823

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

Github link:
https://github.com/0xFatality/CVE-2012-1823

CVE-2024-4879

ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted instances, and ServiceNow released the update to our partners and self-hosted customers. Listed below are the patches and hot fixes that address the vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

Github link:
https://github.com/jdusane/CVE-2024-4879

CVE-2024-3183

None

Github link:
https://github.com/Cyxow/CVE-2024-3183-POC

CVE-2024-22120

Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injection.

Github link:
https://github.com/isPique/CVE-2024-22120-RCE-with-gopher

CVE-2024-21733

None

Github link:
https://github.com/LtmThink/CVE-2024-21733