101645 matches found
CVE-2026-107778
MIT Kerberos 5 krb5 through 1.22.2 contains a NULL pointer dereference in makecredlist in rdcred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticketinfo entries through...
CVE-2026-107708
MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's getpacprincwithrealm that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a...
CVE-2026-107778 MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()
MIT Kerberos 5 krb5 through 1.22.2 contains a NULL pointer dereference in makecredlist in rdcred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticketinfo entries through...
EUVD-2026-95256
MIT Kerberos 5 krb5 through 1.22.2 contains a NULL pointer dereference in makecredlist in rdcred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticketinfo entries through...
CVE-2026-107778
MIT Kerberos 5 (krb5 ) versions through 1.22.2 are vulnerable to a NULL pointer dereference within the make_cred_list() function in rd_cred.c. This flaw occurs when authenticated Kerberos clients send mismatched KRB-CRED arrays, specifically by sending forwarded credentials containing more ticket...
CVE-2026-107778
MIT Kerberos 5 krb5 through 1.22.2 contains a NULL pointer dereference in makecredlist in rdcred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticketinfo entries through...
CVE-2026-107778 MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()
MIT Kerberos 5 krb5 through 1.22.2 contains a NULL pointer dereference in makecredlist in rdcred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticketinfo entries through...
CVE-2026-107708
MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's getpacprincwithrealm that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a...
EUVD-2026-95255
MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's getpacprincwithrealm that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a...
CVE-2026-107708
The MIT krb5 library (versions through 1.22.2 ) is vulnerable to a NULL pointer dereference within the KDC's get_pac_princ_with_realm() function. The flaw occurs when the function processes an S4U2Proxy request containing a PAC with a malformed client name; the function incorrectly returns succes...
CVE-2026-107708
MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's getpacprincwithrealm that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a...
CVE-2026-107708 MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC
MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's getpacprincwithrealm that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a...
CVE-2026-107708 MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC
MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's getpacprincwithrealm that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a...
CVE-2026-34159-Vulnerability-Research-Analysis-Detection
CVE-2026-34159-漏洞研究-分析-检测 deserializetensor 中的关键缓冲区验证绕过（llama.cpp b8492）。空张量缓冲区跳过边界检查，从而可通过 GRAPHCOMPUTE 实现未认证的任意读写。通过 TCP 50052 实现 ASLR 绕过及 RCE。 包含： 技术分析与漏洞利用链 完整的 Wireshark PCAP（HELLO→BUFFERCLEAR） Suricata/Snort 签名 实验室复现（Windows b8487 + WSL PoC） 检测/缓解策略...
CVE-2026-31431
CVE-2026-31431 — 从空指针到 Root：利用 Linux 内核中的 AFALG AEAD 漏洞类型： 空指针解引用 → 堆越界写入 → 凭据覆盖 受影响子系统： net/alg/afalg.c 影响： 本地权限提升（非特权用户 → root） 受影响内核： Linux 4.4 – 4.9（补丁前） 简述 你调用 setsockopt 时传入一个 NULL 指针，而内核期望的是一个用户空间地址。内核从地址 0x00000000 读取数据——如果你已经映射了零页，你就能控制它读取的内容。这一原始原语会滚雪球式地演变为堆越界写入，让你能够覆盖自己的 cred 结构体。游戏结束。...
cve-2026-23398-poc
实验：CVE-2026-23398（ICMP / ipnopmtudisc=3） 针对 Linux 内核 icmptagvalidation 中漏洞的可复现实验（当 net.ipv4.ipnopmtudisc = 3 且收到一条 Fragmentation Needed ICMP 报文，其引用的内部 IPv4 头使用在inetprotos 中无处理程序的协议号时，会发生 NULL 指针解引用）。 仅限授权使用： 仅限您拥有或已获得明确书面许可进行测试的系统。影响为拒绝服务 （内核崩溃）。 主机要求 组件| 用途 ---|--- QEMU...
testanull-CVE-2021-22005.py
此存储库没有 README。...
CVE-2025-4476-Exploit
CVE-2025-4476-Exploit 一个用于发送带有超大 Authorization: Basic 头的 HTTP GET 请求的小型 Python 测试客户端。 该工具旨在用于实验室测试和研究头部解析问题（例如，libsoup 中诸如 CVE-2025-4476 的空指针解引用/崩溃漏洞）。它演示了带有畸形头的客户端-服务器交互如何触发解析错误；它不是一个漏洞利用框架。 用法：仅针对本地或已授权的测试目标运行。 重要提示：请负责任地使用——未经明确许可，请勿扫描或攻击系统。...
Orbit-Fox_SSRF_CVE-2025-10874
CVE-2025-10874 - Orbit Fox SSRF 概念验证 概念验证漏洞利用，演示 Orbit Fox WordPress 插件中存在的服务器端请求伪造（SSRF）漏洞，并利用空字节注入绕过。 详细博客文章：https://ryanmroth.com/articles/orbit-fox-ssrf 漏洞详情 详情| 说明 ---|--- CVE ID：| CVE-2025-10874 受影响插件：| ThemeIsle 的 Orbit Fox 漏洞类型：| 服务器端请求伪造（SSRF）（CWE-918） CVSS 评分：| 5.5（中危） 所需权限：|...
CVE-2025-24990_POC
Windows Agere Modem 驱动程序（ltmdm64.sys）。该驱动程序非常老旧，默认情况下不会在我的测试机器上加载，因此我将在 BYOVD 场景中利用它。有趣的是，根据我的研究，该驱动程序自 Windows 7 起就已存在，并且至少有一个漏洞。此处 当时，MSRC 没有采取任何行动 🤡 漏洞 该驱动程序中的某些 IOCTL 使用了 METHODNEITHER，但未检查调用者提供的地址缓冲区是来自用户模式还是内核模式。以下是我用 OSR 解码的一个示例 IOCTL 代码： 这意味着你可以向 DeviceIoControl API 提供内核地址，驱动程序会正常处理它。...