Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/binganao/vulns-2022

本项目用于搜集 2022 年的漏洞，注意：本项目并不刻意搜集 POC 或 EXP，主要以CVE-2021、CVE-2022 为关键词，包含但不限于漏洞资讯、漏洞复现、漏洞分析、漏洞验证、漏洞利用
https://github.com/binganao/vulns-2022

Last synced: 3 months ago
JSON representation

本项目用于搜集 2022 年的漏洞，注意：本项目并不刻意搜集 POC 或 EXP，主要以CVE-2021、CVE-2022 为关键词，包含但不限于漏洞资讯、漏洞复现、漏洞分析、漏洞验证、漏洞利用

Host: GitHub
URL: https://github.com/binganao/vulns-2022
Owner: binganao
Created: 2022-01-15T00:31:06.000Z (almost 3 years ago)
Default Branch: main
Last Pushed: 2022-04-17T04:01:19.000Z (over 2 years ago)
Last Synced: 2024-05-20T13:31:30.853Z (6 months ago)
Homepage:
Size: 115 KB
Stars: 383
Watchers: 15
Forks: 56
Open Issues: 0
Metadata Files:
- Readme: README.md

Awesome Lists containing this project

StarryDivineSky - binganao/vulns-2022 - 2021、CVE-2022 为关键词，包含但不限于漏洞资讯、漏洞复现、漏洞分析、漏洞验证、漏洞利用 (漏洞库、漏洞靶场 / 网络服务_其他)
awesome-hacking-lists - binganao/vulns-2022 - 本项目用于搜集 2022 年的漏洞，注意：本项目并不刻意搜集 POC 或 EXP，主要以CVE-2021、CVE-2022 为关键词，包含但不限于漏洞资讯、漏洞复现、漏洞分析、漏洞验证、漏洞利用 (Others)

README

        # 搜集 2022 年的漏洞

本项目用于搜集 2022 年的漏洞，**注意:** 本项目并不刻意搜集 POC 或 EXP，包含但不限于漏洞资讯、漏洞复现、漏洞分析、漏洞验证、漏洞利用

目前纯手工搜集，后期可能会加入机器人，漏洞按照更新时间逆序排序

## 命令执行

[Gitlab Enterprise Edition (13.9.5) CVE-2021-22205](https://github.com/ahmad4fifz/CVE-2021-22205)

[A Zero-Click RCE exploit for CVE-2021-0326 on the Peloton Bike](https://github.com/aemmitt-ns/skeleton)

[CVE-2022-24086 about Magento RCE](https://github.com/Mr-xn/CVE-2022-24086)

[Apache APISIX 2.12.1、Apache APISIX 2.10.4 POC(CVE-2022-24112)](https://github.com/shakeman8/CVE-2022-24112)

[向日葵远程控制软件 RCE](https://github.com/TRYblog/sunlogin_rce_)

[Remote Code Execution in TP-Link Tapo c200 IP camera](https://github.com/hacefresko/CVE-2021-4045-PoC)

[Cisco Anyconnect VPN unauth RCE(CVE-2022-20699)](https://github.com/Audiobahn/CVE-2022-20699)

[RCE via Email-Templates (Authenticated only) in SuiteCRM <= 8.0.1(CVE-2021-45897)](https://github.com/manuelz120/CVE-2021-45897)

[CVE-2021-22204 Rxiftool RCE](https://github.com/0xBruno/CVE-2021-22204)

[HongJingEHR多个漏洞(Axis Adminservice远程代码执行漏洞、HongJingEHR未授权反序列化漏洞)](https://www.seebug.org/vuldb/ssvid-99429)

[NUUO NVRmini2 未授权RCE漏洞](https://www.seebug.org/vuldb/ssvid-99452)

[Uniview 未授权RCE漏洞 (CVE-2021-45039)](https://www.seebug.org/vuldb/ssvid-99451)

[SONICWALL SMA100 Apache httpd 未授权RCE (CVE-2021-20038)](https://attackerkb.com/topics/QyXRC1wbvC/cve-2021-20038/rapid7-analysis)

[TerraMaster TOS session 伪造、任意⽂件读取、远程命令执⾏等多个漏洞](https://packetstormsecurity.com/files/165399/terramaster-exec.py.txt)

[H2 数据库控制台未授权 RCE (CVE-2021-42392)](https://jfrog.com/blog/the-jndi-strikes-back-unauthenticated-rce-in-h2-database-console/?utm_campaign=Log4j&utm_content=004atglxq0kpxz6&utm_medium=social&utm_source=twitter)

[Atlassian Jira Server and Data Center 授权RCE漏洞 (CVE-2021-43947)](https://mp.weixin.qq.com/s/XDX5eq3UE51_yLo0Q4wZ0g)

[CVE-2021-41773 Apache HTTP Server 2.4.49 RCE](https://github.com/m96dg/CVE-2021-41773-exercise)

## 权限提升

[Linux CVE-2022-0847-DirtyPipe-Exploit](https://github.com/Arinerron/CVE-2022-0847-DirtyPipe-Exploit)

[Windows CVE-2021-24084 Windows Local Privilege Escalation](https://github.com/exploitblizzard/WindowsMDM-LPE-0Day)

[Windows Exploit for CVE-2022-21999 - Windows Print Spooler Elevation of Privilege Vulnerability (LPE)](https://github.com/ly4k/SpoolFool)

[Linux polkit的pkexec 本地权限升级漏洞 EXP NO GCC(CVE-2021-4034)](https://github.com/EstamelGG/CVE-2021-4034-NoGCC)

[Linux PolKit (polkitd) 0.133 本地提权(CVE-2021-3560)](https://github.com/chenaotian/CVE-2021-3560)

[Windows Exploit for CVE-2022–22718 - Windows Print Spooler Elevation of Privilege Vulnerability (LPE)](https://github.com/ly4k/SpoolFool)

[Windows CVE-2021-1675 is a vulnerability in the Print Spooler Service of Microsoft Windows](https://github.com/AndrewTrube/CVE-2021-1675)

[Windows POC CVE-2022-21882](https://github.com/sailay1996/cve-2022-21882-poc)

[Windows win32k LPE bypass CVE-2022-21882](https://github.com/KaLendsi/CVE-2022-21882)

[Linux polkit的pkexec 本地权限升级漏洞 EXP(CVE-2021-4034)](https://github.com/arthepsy/CVE-2021-4034)

## 拒绝服务

[A-potential-Denial-of-Service-issue-in-protobuf-java](https://github.com/Mario-Kart-Felix/A-potential-Denial-of-Service-issue-in-protobuf-java)

## 代码执行

[Hotel Druid v3.0.3 Code Injection vulnerability (CVE-2022-22909)](https://github.com/0z09e/CVE-2022-22909)

[Remote Code Execution on Confluence Servers(CVE-2021-26084)](https://github.com/0xf4n9x/CVE-2021-26084)

[a-tag with the HTML injection vulnerability in CSV+ <=0.8.0(CVE-2022-21241)](https://github.com/satoki/csv-plus_vulnerability)

[POC for CVE-2022-21907: Windows HTTP协议栈远程代码执行漏洞](https://github.com/antx-code/CVE-2022-21907)

[GoAhead 远程代码执⾏漏洞 (CVE-2021-42342)](https://mp.weixin.qq.com/s/AS9DHeHtgqrgjTb2gzLJZg)

## SQL注入

[Casdoor SQL Injection (CVE-2022-24124)](https://github.com/ColdFusionX/CVE-2022-24124)

[Prestashop >= 1.7.5.0 < 1.7.8.2 - SQL injection(CVE-2021-43789)](https://github.com/numanturle/CVE-2021-43789)

[Moodle 3.11-3.11.4 SQL注入 POC(CVE-2022-0332)](https://github.com/numanturle/CVE-2022-0332)

[PhpIPAM v1.4.4 授权 SQL 注入(CVE-2022-23046)](https://github.com/jcarabantes/CVE-2022-23046)

[CVE-2022-21661-WordPress-Core-5.8.2-WP_Query-SQL-Injection POC](https://github.com/sagittarius-a/cve-2022-21658)

[CVE-2022-21661-WordPress-Core-5.8.2-WP_Query-SQL-Injection](https://github.com/TAPESH-TEAM/CVE-2022-21661-WordPress-Core-5.8.2-WP_Query-SQL-Injection)

[wordpress SQL注入漏洞 (CVE-2022–21661)](https://www.seebug.org/vuldb/ssvid-99431)

## 越权漏洞

[ZABBIX-监控系统 Unsafe Session Storage(CVE-2022-23131)](https://github.com/0tt7/CVE-2022-23131)

[ZABBIX-监控系统-Saml-bypass-poc(CVE-2022-23131)](https://github.com/1mxml/CVE-2022-23131)

[CVE-2022-22828 Synametrics - SynaMan version 4.9 存在越权漏洞](https://github.com/videnlabs/CVE-2022-22828)

[Hospital's Patient Records Management System 1.0(CVE-2022-22296)](https://github.com/vlakhani28/CVE-2022-22296)

[Gin-Vue-admin垂直越权漏洞与代码分析 (CVE-2022-21660)](https://github.com/UzJu/Gin-Vue-admin-poc-CVE-2022-21660)

## 信息泄露

[WebLogic 信息泄露漏洞(CVE-2022-21252)](https://www.oracle.com/security-alerts/cpujan2022.html#AppendixFMW)

[Import Export WordPress plugin(CVE-2022-0236)](https://github.com/qurbat/CVE-2022-0236)

## 容器逃逸

[Sample Ubuntu LPEs and container escapes CVE-2022-0185 分析](https://github.com/chenaotian/CVE-2022-0185)

[Sample Ubuntu LPEs and container escapes coming soon(CVE-2022-0185)](https://github.com/Crusaders-of-Rust/CVE-2022-0185)

## 外部实体

[Andrid XML外部实体引用inskylot/jadx的不当限制(CVE-2022-0219)](https://github.com/Haxatron/CVE-2022-0219)

## XSS

[Stored XSS Vulnerability on RosarioSIS 8.2.1(CVE-2021-45416)](https://github.com/dnr6419/CVE-2021-45416)

[SAS Logon 9.4 allows warning-message injection(CVE-2022-25257)](https://github.com/polling-repo-continua/CVE-2022-25257)

[Reflected XSS in TastyIgniter v3.2.2 Restaurtant CMS(CVE-2022-23378)](https://github.com/TheGetch/CVE-2022-23378)

[Stored Cross Site Scripting Sourcecodester Online Car Rental System 1.0(CVE-2021-46005)](https://github.com/nawed20002/CVE-2021-46005)

[Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1(CVE-2021-45416)](https://github.com/86x/CVE-2021-45416)

[D-Link Router DSL-2730E - Stored Cross Site Scripting (XSS)(CVE-2021-46108)](https://github.com/g-rubert/CVE-2021-46108)

[Ivanti Service Manager 2021.1 infected with reflected XSS(CVE-2021-38560)](https://github.com/os909/iVANTI-CVE-2021-38560)

[RosarioSIS 8.2.1 反射式跨站点脚本(CVE-2021-45416)](https://github.com/86x/CVE-2021-45416)

[HPRMS - 'room_list' Stored XSS(CVE-2022-22852)](https://github.com/Sant268/CVE-2022-22852/blob/main/CVE-2022-22852.md)

[HPRMS - 'doctors' Stored XSS(CVE-2022-22851)](https://github.com/Sant268/CVE-2022-22851/blob/main/CVE-2022-22851.md)

[HPRMS - 'room_types' Stored XSS(CVE-2022-22850)](https://github.com/Sant268/CVE-2022-22850/blob/main/CVE-2022-22850.md)

## 文件上传

[Spring4Shell-POC (CVE-2022-22965)](https://github.com/BobTheShoplifter/Spring4Shell-POC)

[WordPress File Upload Vulnerability, Modern Events Calendar Lite WordPress plugin before 5.16.5(CVE-2021-24145)](https://github.com/dnr6419/CVE-2021-24145)

## 文件包含

[Oracle WebLogic Server 12.1.3.0.0/12.2.1.3.0/12.2.1.4.0/14.1.1.0.0 本地文件包含(CVE-2022-21371)](https://github.com/Mr-xn/CVE-2022-21371)

## SSRF

[Microsoft Exchange ProxyLogon PoC (CVE-2021-26855)](https://github.com/thau0x01/poc_proxylogon)

## SSTI

[VMware CVE-2022-22954 Workspace ONE Access Freemarker Server-side Template Injection](https://github.com/sherlocksecurity/VMware-CVE-2022-22954)

## 其他

[CVE-2021-45901 (ServiceNow - Username Enumeration)](https://github.com/9lyph/CVE-2021-45901)