research

Security Research Repository dedicated to my security vulnerability discoveries CVEs. This repository contains detailed technical documentation, proof-of-concept exploits, and analysis of discovered vulnerabilities. About This repository aggregates all CVEs I have discovered and researched,...

witchcraft

🎉 Tu compañero de OPSEC. Ejecuta witchcraft help o witchcraft manual para el manual completo 🎉 ¿Qué hace? WITCHCRAFT es mucho más que un simple alias; es un sistema de inicio que puede funcionar con busybox, un shell y un motor de automatización para hacking, OSINT, forense, etc. NOMBRE witchcraf...

busybox-1.38.0-3.1 on GA media (moderate)

busybox-1.38.0-3.1 on GA media Announcement ID: openSUSE-SU-2026:11954-1 Rating: moderate Cross-References: CVE-2026-88830 CVE-2026-88831 CVE-2026-88832 CVE-2026-88835 CVE-2026-88837 CVE-2026-88839 CVE-2026-88841 CVSS scores: CVE-2026-88830 SUSE : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H...

CVE-2025-60876

CVE-2025-60876: busybox wget request-target injection fix A behavior-preserving fix for CVE-2025-60876, an HTTP header-injection vulnerability in BusyBox wget, plus the proof-of-concept that demonstrates it and the artifacts for submitting the fix upstream to BusyBox. The vulnerability BusyBox wg...

CVE-2014-0196

See https://vulners.com/cve/CVE-2014-0196...

PT-2026-105992

These are all security issues fixed in the busybox-1.38.0-3.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-105663

These are all security issues fixed in the busybox-1.38.0-3.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11954-1 busybox-1.38.0-3.1 on GA media

These are all security issues fixed in the busybox-1.38.0-3.1 package on the GA media of openSUSE Tumbleweed...

CentOS Linux 6 [TuxCare] Security Update: busybox / busybox-petitboot Multiple Vulnerabilities (CENTOS6:CLSA-2026:1776960429)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1776960429 advisory. - In the addmatch function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list ...

Low: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: busybox: busybox-1.37.0-9.2.hum1 aarch64, x8664 busybox-petitboot-1.37.0-9.2.hum1 aarch64, x8664 busybox-shared-1.37.0-9.2.hum1 aarch64, x8664 busybox-1.37.0-9.2.hum1.src src Security Fixes:...

busybox: busybox: dpkg write_status_file() stale cursor causes out-of-bounds read and status file corruption

BusyBox dpkg writestatusfile does not reset a stale field cursor between package stanzas, causing out-of-bounds reads and status file corruption when removing multiple packages...

ROOT-OS-ALPINE-317-CVE-2022-48174 CVE-2022-48174 in busybox - Patched by Root

Root has patched CVE-2022-48174 in the busybox package for Root:Alpine:3.17. Multiple fixed versions available...

ROOT-OS-ALPINE-315-CVE-2022-48174 CVE-2022-48174 in busybox - Patched by Root

Root has patched CVE-2022-48174 in the busybox package for Root:Alpine:3.15. Multiple fixed versions available...

Linux Distros Unpatched Vulnerability : CVE-2026-88841

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - busybox - None CVE-2026-88841 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, In...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: busybox: busybox-1.37.0-9.1.hum1 aarch64, x8664 busybox-petitboot-1.37.0-9.1.hum1 aarch64, x8664 busybox-shared-1.37.0-9.1.hum1 aarch64, x8664 busybox-1.37.0-9.1.hum1.src src Security Fixes:...

busybox: busybox: romfs volume ID parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images...

busybox: busybox: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb packages

BusyBox dpkg readpackagefield steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read...

busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint

BusyBox passwd/group tokenize references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers...

busybox: busybox: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...

busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...