encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

EulerOS 2.0 SP12 : shim (EulerOS-SA-2026-3386)

According to the versions of the shim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: A specially crafted PKCS7 or S/MIME signed message could trigger a use-after-free during PKCS7 signature verification. Impact summary...

EulerOS 2.0 SP12 : shim (EulerOS-SA-2026-3311)

According to the versions of the shim package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: A specially crafted PKCS7 or S/MIME signed message could trigger a use-after-free during PKCS7 signature verification. Impact summary:...

CLSA-2026-1788806164 TuxCare security update for org.springframework.graphql (3 CVEs)

TuxCare rebuilt 2 org.springframework.graphql packages to address 3 CVEs. Fixed in 1.4.6-tuxcare.1...

struts1filter

struts1filter Una solución de filtro de parámetros de solicitud para Apache Struts 1 CVE-2014-0114 basada en el trabajo de Alvaro Munoz y el equipo de HP Fortify. Para usar este filtro, añade la siguiente declaración de filtro junto con el mapeo apropiado al descriptor web.xml de la aplicación...

pwnage24mtk

pwnage24mtk Exploit de certificados para dispositivos MTK. Hay una falla lógica en el proceso de verificación de certificados de MTK. Similar a CVE-2023-20696. Puede estar parcheado en junio. Aviso legal Este proyecto se utiliza únicamente para investigación. Asegúrate de obtener autorización ant...

iBSSloader

iBSSloader Investigación y herramientas para arrancar Linux en iPad mini 1 P105AP / iPad2,5, Apple A5 mediante checkm8, iBSS/iBEC parcheados y payloads personalizados de bare-metal — sin escribir en la instalación de iOS. Este repositorio combina: Port del device tree — Apple ADT → DTS/DTB de Lin...

CVE-2026-85103 - ASN.1 decoding heap overflow leading to a remote code execution

Symptoms - Issue: A heap overflow in the VPN certificate ASN.1 decoding flow may allow a remote attacker to remotely execute arbitrary code on the management and Security Gateway. This issue received the ID CVE-2026-85103 with CVSS: 9.8. Affected Products: Security Management Server, Security...

Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)

"The remote Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8728-1 advisory. It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memo...

CVE-2020-9484

CVE-2020-9484 Referencia Escrito por redtimmysec, masahiro331 https://packetstormsecurity.com/files/157924/CVE-2020-9484.tgz + Acabo de analizar un exploit de 1 día. Luego lo remodelé. Descripción En comparación con el PoC anterior, tiene las siguientes ventajas. + Script de entorno para Ubuntu...

cve-2024-58239

exploit de mitigación CVE-2024-58239 Este es mi primer exploit de 1 día. Parche: tls: stop recv if initial processrxlist gave us non-DATA Vi exp407 en la hoja de cálculo de kernelCTF e intenté reproducir el exploit. Logré ejecutar el exploit en el entorno de kernelCTF y obtuve la bandera: Escribi...

EUVD-2026-72026

MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures during X.509 validation. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted...

CVE-2026-67278 TLS server impersonation possible in Mikrotik RouterOS

MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures during X.509 validation. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted...

CVE-2026-67278 TLS server impersonation possible in Mikrotik RouterOS

MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures during X.509 validation. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted...

CVE-2026-67278

MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures during X.509 validation. Because its trust store includes a root CA with e=3 , an attacker who controls or redirects an outbound TLS connection can use the root's public certificate—without its private key—to forge a trusted intermedi...

PT-2026-86453

MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures during X.509 validation. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted...

CVE-2026-82631 affecting package valkey for versions less than 8.0.11-1

CVE-2026-82631 affecting package valkey for versions less than 8.0.11-1. An upgraded version of the package is available that resolves this issue...