CVE-2021-41091

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade limit access to the host to trusted users. Limit access to host volumes to trusted contai

Github link:
https://github.com/SNE-M23-SN/Vulnerable-Docker-Engine

CVE-2024-21413

Microsoft Outlook Remote Code Execution Vulnerability

Github link:
https://github.com/DerZiad/CVE-2024-21413

CVE-2024-29972

None

Github link:
https://github.com/Pommaq/CVE-2024-29972-CVE-2024-29976-CVE-2024-29973-CVE-2024-29975-CVE-2024-29974-poc

CVE-2024-34102

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

Github link:
https://github.com/0x0d3ad/CVE-2024-34102

CVE-2024-34102

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

Github link:
https://github.com/11whoami99/CVE-2024-34102

CVE-2024-5961

None

Github link:
https://github.com/kac89/CVE-2024-5961

CVE-2024-6387

None

Github link:
https://github.com/zgzhang/cve-2024-6387-poc

CVE-2019-18818

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.

Github link:
https://github.com/Hackhoven/Strapi-RCE

CVE-2024-20666

BitLocker Security Feature Bypass Vulnerability

Github link:
https://github.com/invaderslabs/CVE-2024-20666

CVE-2024-34102

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

Github link:
https://github.com/jakabakos/CVE-2024-34102-CosmicSting-XXE-in-Adobe-Commerce-and-Magento

CVE-2021-4034

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

Github link:
https://github.com/evkl1d/CVE-2021-4034

CVE-2024-6387

None

Github link:
https://github.com/TrustResearcher/CVE-2024-6387-Updated-SSH-RCE

CVE-2024-6050

None

Github link:
https://github.com/kac89/CVE-2024-6050

CVE-2019-6111

An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).

Github link:
https://github.com/mbadanoiu/MAL-008

CVE-2024-6387

None

Github link:
https://github.com/FerasAlrimali/CVE-2024-6387-POC

CVE-2024-6387

None

Github link:
https://github.com/lflare/cve-2024-6387-poc

CVE-2024-6387

None

Github link:
https://github.com/acrono/cve-2024-6387-poc

CVE-2024-28995

SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.

Github link:
https://github.com/Stuub/CVE-2024-28995

CVE-2024-38366

None

Github link:
https://github.com/ReeFSpeK/CocoaPods-RCE

CVE-2024-29269

An issue discovered in Telesquare TLR-2005Ksh 1.0.0 and 1.1.4 allows attackers to run arbitrary system commands via the Cmd parameter.

Github link:
https://github.com/K3ysTr0K3R/CVE-2024-29269-EXPLOIT