Tracking
Vulnerabilities
The bugs that reshaped the industry, taken apart one at a time: the flawed assumption underneath, the path to exploitation, and what it cost the people who ran the software.
The library
7 of 9 write-ups rated critical. Each one is the analysis I wanted to find when it landed.
- CVE-2024-309410.0critical
Backdoor in xz-utils liblzma
A multi-year social engineering campaign planted a backdoor in the xz release tarballs, hooking sshd via liblzma.
xz-utils
- CVE-2023-4966 Exploited9.4critical
CitrixBleed: session token leak in NetScaler ADC
An unauthenticated buffer over-read leaks session tokens from memory, allowing MFA to be bypassed by replaying a hijacked session.
Citrix PoC
- CVE-2022-22965 Exploited9.8critical
Spring4Shell: RCE in Spring Framework
Data binding in Spring MVC on JDK 9+ could be abused to reach class-loader properties and write a web shell, giving remote code execution.
VMware PoC
- CVE-2021-26855 Exploited9.8critical
ProxyLogon: pre-auth SSRF in Exchange
An SSRF in Microsoft Exchange chained to arbitrary file write for unauthenticated RCE. Mass-exploited against on-prem Exchange worldwide.
Microsoft PoC
- CVE-2019-0708 Exploited9.8critical
BlueKeep: pre-auth RCE in RDP
A use-after-free in Remote Desktop Services allowed unauthenticated, wormable remote code execution against a huge installed base of Windows hosts.
Microsoft PoC
- CVE-2021-44228 Exploited10.0critical
Log4Shell: JNDI lookup injection in Log4j 2
User-controlled strings reaching a Log4j 2 logging call trigger a JNDI lookup, giving remote code execution.
Apache PoC
- CVE-2014-6271 Exploited9.8critical
Shellshock: arbitrary code execution in Bash
Bash evaluated trailing code in specially crafted environment variables, giving RCE through anything that passed attacker input into the environment — CGI especially.
GNU PoC