witchcraft

🎉 Your OPSEC companion. Run witchcraft help or witchcraft manual for the complete manual 🎉 What it does? WITCHCRAFT Are much more than a simple alias, it's a init system that can works with busybox, a shell and automation's and automation's engine for hacking, osint, forensics, etc. NAME witchcra...

CVE-2025-60876

CVE-2025-60876：busybox wget リクエストターゲットインジェクション修正 CVE-2025-60876（BusyBox wget における HTTP ヘッダインジェクション脆弱性）に対する動作を維持する修正、それを実証する概念実証、および修正を BusyBox にアップストリーム提出するための成果物です。 脆弱性 BusyBox wget は、URL のパスとクエリを HTTP リクエスト行にそのままコピーします。生の CR 0x0D、LF 0x0A、またはその他の制御バイトを含む URL...

OESA-2026-3763 busybox security update

The Swiss Army Knife of Embedded Linux Security Fixes: A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATUREWGETTIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference...

Astra Linux – Vulnerability in busybox

A use-after-free in Busybox’s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvars function...

CVE-2014-0196

참조 https://vulners.com/cve/CVE-2014-0196...

research

セキュリティ研究 私が発見したセキュリティ脆弱性（CVE）に関するリポジトリです。本リポジトリには、発見した脆弱性の詳細な技術文書、概念実証（PoC）エクスプロイト、および分析が含まれています。 概要 本リポジトリは、私が発見・調査したすべてのCVEをまとめたもので、以下を含みます： 各脆弱性の詳細な技術分析 教育目的の概念実証（PoC）コード 攻撃シナリオと影響評価 修正状況とパッチ情報 公式CVEレコードへの参照 発見したCVE CVE-2026-26158 - BusyBox Hardlink Bypass 9.3 緊急 CVE-2026-26157 - BusyBox Path...

CVE-2026-76014

A flaw was found in BusyBox. A local attacker can exploit a null pointer dereference vulnerability in the FEATUREWGETTIMEOUT handler within the networking/wget.c component. This occurs when the attacker manipulates the -T argument, leading to a denial of service. Mitigation Mitigation for this...

OESA-2026-3685 busybox security update

The Swiss Army Knife of Embedded Linux Security Fixes: A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATUREWGETTIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference...

OESA-2026-3686 busybox security update

The Swiss Army Knife of Embedded Linux Security Fixes: A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATUREWGETTIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference...

OESA-2026-3684 busybox security update

The Swiss Army Knife of Embedded Linux Security Fixes: A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATUREWGETTIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference...

OESA-2026-3683 busybox security update

The Swiss Army Knife of Embedded Linux Security Fixes: A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATUREWGETTIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference...

The vulnerability of the udhcp_getoption() function in the networking/udhcp/common.c component of the BusyBox command-line utility tools allows a attacker to gain access to confidential data.

The vulnerability of the udhcpgetoption function in the networking/udhcp/common.c component of the BusyBox command-line utility tools on UNIX systems is related to reading data from a buffer beyond its allowable limits. Exploiting this vulnerability could allow an attacker to gain access to...

CVE-2026-38754

A flaw was found in Busybox. This vulnerability, a heap overflow, exists within the ifsbreakup function. A remote attacker could exploit this by providing specially crafted input, leading to a Denial of Service DoS condition. This means the affected system or application could become unavailable ...

Astra Linux – Vulnerability in busybox

There is a stack overflow vulnerability in ash.c:6030 in busybox before version 1.35. In the environment of the Internet of Vehicles, this vulnerability can lead to the execution of arbitrary code from commands...

Astra Linux – Vulnerability in busybox

An out-of-bounds heap read in Busybox’s unlzma applet leads to information leakage and denial of service when LZMA-compressed input is decompressed. This can be triggered by any applet/format that…...

Astra Linux – Vulnerability in busybox

A use-after-free condition in Busybox’s awk applet leads to denial of service and potentially code execution when processing a crafted awk pattern in the nextinputfile function...

Astra Linux – Vulnerability in busybox

A use-after-free in Busybox’s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hashinit function...

Astra Linux – Vulnerability in busybox

Busybox contains a vulnerability related to SSL certificate validation. This vulnerability exists in the “busybox wget” applet, and it can lead to the execution of arbitrary code. This vulnerability appears to be exploitable by simply downloading any file over an HTTPS connection using “busybox...

Astra Linux – Vulnerability in busybox

A use-after-free in Busybox’s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function...

Astra Linux – Vulnerability in busybox

A use-after-free condition in Busybox’s awk applet leads to denial of service and potentially code execution when processing a crafted awk pattern in the getvari function...