AiRedTeam - 我当黑客那几年(AiRedTeam) (Page 52)

[webapps] glances 4.5.2 - command injection

CVE-2026-33641 Glances 4.5.2及以下版本配置解析中反引号内子串执行任意命令导致命令注入 High · CVSS 7.8 📋 漏洞基础信息 CVECVE-2026-33641漏洞类型命令注入 (OS Command Injection, CWE-78)受影响版本Glances 4.5.2 and below (fixed in 4.5.3)危害等级High · CVSS 7.8发布日期2026-05-13提交者Stepanov Daniil来源Exploit-DB 原文 ↗ 🔬 漏洞根因在 glances/config.py 的 Config.get_value() 方法中，使用正则查找配置值中的反引号子串并通过 system_exec() 执行，system_exec() 在 glances/

漏洞分析

[webapps] glances 4.5.2 - command injection

CVE-2026-33641 Glances配置解析中反引号内子串被作为系统命令执行导致命令注入 High · CVSS 7.8 📋 漏洞基础信息 CVECVE-2026-33641漏洞类型OS命令注入（CWE-78）受影响版本glances 4.5.2及以下版本（修复于4.5.3）危害等级High · CVSS 7.8发布日期2026-05-13提交者Stepanov Daniil来源Exploit-DB 原文 ↗ 🔬 漏洞根因在glances/config.py的Config.get_value()方法中，使用正则匹配反引号包围的子串，并通过glances/globals.py中的system_exec()函数调用subprocess.run()执行该命令，未对命令内容做任何验证或限制。 🎯 攻击场景 1. 攻击者需具有修改或影响Glances配置文件的能力（例如通过文件写入漏洞、共享配置目录写入权限等）。 2. 在配置文件的任意配置项值中插入反引号包裹的恶意命令，例如`touch /tmp/glances_pwned`

漏洞分析

[webapps] Ninja Forms Uploads - Unauthenticated PHP File Upload

CVE-2026-0740 漏洞 High · CVSS N/A 📋 漏洞基础信息 CVECVE-2026-0740漏洞类型漏洞受影响版本详见原文危害等级High · CVSS N/A发布日期2026-05-13提交者Sélim Lanouar (@whattheslime)来源Exploit-DB 原文 ↗ ⚔️ 原始 PoC # Exploit Author: Sélim Lanouar (@whattheslime) # Fofa Query: body="nfpluginsettings.js?ver=" # Shodan Query: http.html:"nfpluginsettings.js?ver=" # ============================================================================= if [ "$#" -ne 1 ];then echo "Usage: $0 <

漏洞分析

TeamPCP供应链攻击：安全工具沦为数据窃取跳板，50万台机器沦陷

CVE-2025-55182（React2Shell）是React Server 19.x版本的严重远程代码执行漏洞，CVSS 9.8。攻击者可利用特制请求在服务器上执行任意命令，导致完全受控。该漏洞已被野外利用，结合供应链攻击影响数百万DevOps环境。立即升级至19.2.1或应用临时缓解措施。

APT情报

32年老漏洞重现：GNU inetutils Telnetd预认证远程代码执行漏洞（CVE-2026-32746）

🔓 Critical 漏洞利用攻击者可通过发送特制的LINEMODE SLC（Set Linemode Characters）协商数据包，在无需认证的情况下触发GNU inetutils Telnetd中的BSS缓冲区溢出漏洞，破坏相邻变量并实现远程代码执行。该漏洞自1994年引入，影响Ubuntu、Debian、FreeBSD、NetBSD、Citrix NetScaler、Apple Mac Tahoe、Haiku、TrueNAS Core、uCLinux、libmtev、DragonFlyBSD等多个主流系统和设备。来源：watchTowr Labs | 0 | 原文链接 🔍 关键发现 * 漏洞位于GNU inetutils Telnetd的LINEMODE SLC（Set Linemode Characters）协商处理函数中，是一个BSS缓冲区溢出漏洞，可覆盖约400字节的相邻变量。 * 该漏洞无需认证即可触发（Pre-Auth），攻击者通过发送IAC SB LINEMODE LM_

漏洞分析

CVE-2018-25335 (CVSS 9.8) - WordPress Plugin Peugeot Music 1.0 contains an arbitrary file upload vulnerabili

漏洞分析

CVE-2018-25332 (CVSS 9.8) - GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability

漏洞分析

CVE-2018-25320 (CVSS 9.8) - ACL Analytics versions 11.x through 13.0.0.579 contain an arbitrary code executi

安全情报

Bugs that survive the heat of continuous fuzzing

📡 GitHub Security Lab · 0 Bugs that survive the heat of continuous fuzzing CVE-2024-24826CVE-2025-54080CVE-2022-40303CVE-2025-26623 Want to learn how to start fuzzing? Check out our Fuzzing 101 course at gh.io/fuzzing101 > Bugs that survive the heat of continuous fuzzing Learn why some long-enrolled OSS-Fuzz projects still contain vulnerabilities and how

安全情报

How to scan for vulnerabilities with GitHub Security Lab’s open source AI-powered framework

📡 GitHub Security Lab · 0 How to scan for vulnerabilities with GitHub Security Lab’s open source AI-powered framework CVE-2026-25757CVE-2026-25758CVE-2025-64487CVE-2026-28514 For the last few months, we’ve been using the GitHub Security Lab Taskflow Agent along with a new set of auditing taskflows that specialize in finding web security vulnerabilities. They

安全情报

A year of open source vulnerability trends: CVEs, advisories, and malware

📡 GitHub Security Lab · 0 A year of open source vulnerability trends: CVEs, advisories, and malware Jonathan Evans Security Analyst, curator of the GitHub Advisory Database, and one of the members of the Security Lab responsible for issuing CVE IDs and publishing CVE records. Reviewed advisories hit a four-year low, malware

安全情报

Is It CitrixBleed4? Well, No. Is It Good? Also, No. (Citrix NetScaler Memory Leak & RXSS CVE-2025-12101)

📡 watchTowr Labs · 0 Is It CitrixBleed4? Well, No. Is It Good? Also, No. (Citrix NetScaler Memory Leak & RXSS CVE-2025-12101) CVE-2025-12101CVE-2025-5777 Is It CitrixBleed4? Well, No. Is It Good? Also, No. (Citrix NetScaler Memory Leak & RXSS CVE-2025-12101) There’s an elegance to vulnerability research that feels almost poetic -

安全情报

When The Impersonation Function Gets Used To Impersonate Users (Fortinet FortiWeb Auth. Bypass CVE-2025-64446)

📡 watchTowr Labs · 0 When The Impersonation Function Gets Used To Impersonate Users (Fortinet FortiWeb Auth. Bypass CVE-2025-64446) CVE-2025-64446 When The Impersonation Function Gets Used To Impersonate Users (Fortinet FortiWeb Auth. Bypass CVE-2025-64446) The Internet is ablaze, and once again we all have a front-row seat - a bad person, if

安全情报

SOAPwn: Pwning .NET Framework Applications Through HTTP Client Proxies And WSDL

📡 watchTowr Labs · 0 SOAPwn: Pwning .NET Framework Applications Through HTTP Client Proxies And WSDL CVE-2025-34392CVE-2025-13659 SOAPwn: Pwning .NET Framework Applications Through HTTP Client Proxies And WSDL Welcome back! As we near the end of 2025, we are, of course, waiting for the next round of SSLVPN exploitation to occur in

安全情报

Do Smart People Ever Say They’re Smart? (SmarterTools SmarterMail Pre-Auth RCE CVE-2025-52691)

📡 watchTowr Labs · 0 Do Smart People Ever Say They’re Smart? (SmarterTools SmarterMail Pre-Auth RCE CVE-2025-52691) CVE-2025-52691 Do Smart People Ever Say They’re Smart? (SmarterTools SmarterMail Pre-Auth RCE CVE-2025-52691) Welcome to 2026! While we are all waiting for the scheduled SSLVPN ITW exploitation programming that occurs every January, we’

安全情报

Attackers With Decompilers Strike Again (SmarterTools SmarterMail WT-2026-0001 Auth Bypass)

📡 watchTowr Labs · 0 Attackers With Decompilers Strike Again (SmarterTools SmarterMail WT-2026-0001 Auth Bypass) CVE-2025-52691 Attackers With Decompilers Strike Again (SmarterTools SmarterMail WT-2026-0001 Auth Bypass) Well, well, well - look what we’re back with. You may recall that merely two weeks ago, we analyzed CVE-2025-52691 - a pre-auth RCE vulnerability

安全情报

📊 2026-05-18 漏洞情报日报 · 200 条 · 高危 98

每日漏洞情报汇总 · 2026-05-18 📊 2026-05-18 漏洞情报日报 📋 共 200 条 🔥 高危/严重 98 条 💣 Exploit-DB-RSS 3 条 🐙 GitHub-Advisory 25 条 🔥16 🛡️ NVD-Latest 82 条 🔥82 ⚔️ Sploitus 90 条 🤖 今日安全态势分析 🎯 今日重点关注 * CVE-2026-8398 (CVSS 9.8) - DAEMON Tools Lite 供应链攻击：官方安装包被植入恶意代码，影响Windows版本12.5.0.2421至12.5.0.2434。攻击者通过合法分发渠道投放后门，用户安装即被控，利用条件极低，危害范围广。 * CVE-2018-25332 (CVSS

APT情报

cPanel & WHM认证绕过零日漏洞(CVE-2026-41940)：互联网管理面板的“多米诺骨牌”倒塌

🔓 Critical 漏洞利用安全研究人员发现cPanel & WHM所有受支持版本中存在一个严重的认证绕过漏洞（CVE-2026-41940），该漏洞源于会话加载与保存过程中的输入验证不完善，允许攻击者通过精心构造的会话数据绕过认证，获得服务器root级管理权限。已知Host已确认该漏洞在野外被积极利用，作为零日漏洞攻击互联网上大量共享托管基础设施。来源：watchTowr Labs | 0 | 原文链接 🔍 关键发现 * 漏洞影响cPanel & WHM所有受支持版本（110.0.x至136.0.x），覆盖超过7000万个域名。 * 漏洞根源是saveSession函数中filter_sessiondata调用时机不当，导致CRLF注入和目录遍历等攻击向量可被利用。 * 补丁将filter_sessiondata调用移至saveSession内部，并引入了新的十六进制回传编码逻辑，以防御会话数据篡改。 * 会话文件结构分析显示，攻击者可通过伪造pass字段中的换行符注入恶意会话属性，从而提升权限或绕过认证。 ⚔️ 攻击链分析 1. 攻击者向cPane

APT情报

Progress ShareFile存储控制器曝高危漏洞链：未授权RCE风险

🔓 Critical 漏洞利用研究者发现Progress ShareFile Storage Zone Controller 5.x版本中存在认证绕过（CVE-2026-2699）与远程代码执行（CVE-2026-2701）漏洞组合，攻击者可利用/ConfigService/Admin.aspx等端点绕过访问限制，进而执行任意代码。该漏洞链影响约3万个自托管实例，威胁文件传输安全。来源：watchTowr Labs | 0 | 原文链接 🔍 关键发现 * CVE-2026-2699：/ConfigService/Admin.aspx端点存在认证绕过，可被远程利用获取管理访问权限 * CVE-2026-2701：结合认证绕过后，可在未授权状态下实现远程代码执行 * 漏洞影响ShareFile Storage Zone Controller 5.12.3及更早版本，5.12.4已修复 ⚔️ 攻击链分析 1. 攻击者远程访问/ConfigService/Admin.aspx端点，

漏洞分析

Exploit for CVE-2026-4882 exploit

漏洞分析

Exploit for CVE-2026-6433 exploit

漏洞分析

Exploit for CVE-2026-42897 exploit

安全情报

Someone Knows Bash Far Too Well, And We Love It (Ivanti EPMM Pre-Auth RCEs CVE-2026-1281 & CVE-2026-1340)

📡 watchTowr Labs · 0 Someone Knows Bash Far Too Well, And We Love It (Ivanti EPMM Pre-Auth RCEs CVE-2026-1281 & CVE-2026-1340) CVE-2026-1340CVE-2026-1281 Someone Knows Bash Far Too Well, And We Love It (Ivanti EPMM Pre-Auth RCEs CVE-2026-1281 & CVE-2026-1340) When Ivanti removed the embargoes from CVE-2026-1281 and CVE-2026-1340 - actively exploited

安全情报

Buy A Help Desk, Bundle A Remote Access Solution? (SolarWinds Web Help Desk Pre-Auth RCE Chain(s))

📡 watchTowr Labs · 0 Buy A Help Desk, Bundle A Remote Access Solution? (SolarWinds Web Help Desk Pre-Auth RCE Chain(s)) CVE-2024-28986CVE-2025-40554CVE-2025-26399CVE-2025-40553 Buy A Help Desk, Bundle A Remote Access Solution? (SolarWinds Web Help Desk Pre-Auth RCE Chain(s)) It’s been a while, but we’re back - in time

安全情报

The Most Organized Threat Actors Use Your ITSM (BMC FootPrints Pre-Auth Remote Code Execution Chains)

📡 watchTowr Labs · 0 The Most Organized Threat Actors Use Your ITSM (BMC FootPrints Pre-Auth Remote Code Execution Chains) CVE-2025-24813CVE-2025-71260CVE-2025-71257CVE-2025-71258 The Most Organized Threat Actors Use Your ITSM (BMC FootPrints Pre-Auth Remote Code Execution Chains) SolarWinds. Ivanti. SysAid. ManageEngine. Giants of the KEV world, all of whom have ITSM side-projects. ITSMs,