ExecASLR-ekoparty

ExecASLR - 利用Intel分支预测器绕过ASLR 什么是ASLR 地址空间布局随机化（ASLR）是一种用于增加内存破坏攻击利用难度的缓解机制。例如，在缓冲区溢出漏洞场景中，试图构造返回导向编程（ROP）利用的攻击者需要知道链中gadget的地址。如果被利用的二进制文件的代码段被随机化，那么攻击者就很难为exploit选择正确的地址，从而使得利用不可行。 以下示例展示了地址如何被随机化： root@kitploit: include void DoNothing; void codePtr = DoNothing; void DoNothing int mainint...

CVE-2017-16995

CVE-2017-16995 A record of my own tinkering with the CVE-2017-16995 vulnerability and related analysis Hopefully I can find one myself, lol Overview This vulnerability is an LPE caused by an error in the verifier's branch judgment during BPF virtual execution In essence, it is an integer extensio...

CVE-2026-25232-PoC

CVE-2026-25232 — Gogs 受保护分支删除绕过（写入 → 管理员权限提升） 概述 字段| 详情 ---|--- CVE| CVE-2026-25232 产品| Gogs（Go Git 服务） 受影响版本| :3001 攻击者账户： attacker:Password123!（对仓库具有写入权限） 目标仓库： admin/important-repo 受保护分支： main（默认分支） 步骤 1 — 确认分支保护已启用 确认该分支已受保护且无法通过正常方式删除： root@kitploit: 尝试通过 API 正常删除分支 - 此操作应失败 curl -s -X DELET...

CVE-2026-85469

A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream Noelware/docker-manifest-action used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive...

CVE-2026-85469 Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scope

A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream Noelware/docker-manifest-action used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive...

CVE-2026-85469

quay-builder-qemu contains a flaw in its release workflow, where the third-party GitHub Action Noelware/docker-manifest-action is pinned to a mutable @master branch . Because the reference is not fixed to a specific commit, a remote attacker who compromises the upstream action repository can inje...

DEBIAN-CVE-2026-89984

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix kernel address leakages in LBR stack Before Arch LBR gained CPL filtering support, a user-only branch stack could still contain kernel addresses. As a result, kernel branch records may be exposed to user space...

CVE-2026-87164

Vulnerability in the Oracle Banking Branch product of Oracle Financial Services Applications component: Reports. Supported versions that are affected are 14.5.0.0.0-14.9.0.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-83080

Vulnerability in the Oracle Banking Branch product of Oracle Financial Services Applications component: Reports. Supported versions that are affected are 14.5.0.0.0-14.9.0.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-87164

Oracle Banking Branch (Oracle Financial Services Applications), component: Reports , is affected in supported versions 14.5.0.0.0 through 14.9.0.0.0 . A low-privileged attacker with network access via HTTP can exploit this vulnerability, though it is rated as difficult to exploit and requires hum...

EUVD-2026-79819

Vulnerability in the Oracle Banking Branch product of Oracle Financial Services Applications component: Reports. Supported versions that are affected are 14.5.0.0.0-14.9.0.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-83080

Oracle Banking Branch (component: Reports ) in Oracle Financial Services Applications versions 14.5.0.0.0 through 14.9.0.0.0 contains a vulnerability that allows a low-privileged attacker with network access via HTTP to achieve full compromise (high confidentiality, integrity, and availability im...

EUVD-2026-79408

Vulnerability in the Oracle Banking Branch product of Oracle Financial Services Applications component: Reports. Supported versions that are affected are 14.5.0.0.0-14.9.0.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-55158 Conflibot: Command injection via crafted pull request branch names under pull_request_target

Conflibot warns in advance when merging a pull request will cause conflicts in other open pull requests. Prior to 1.2.1, src/index.ts builds git checkout, git merge, and git format-patch commands by interpolating the attacker-controlled pull request head.ref value into strings passed to exec. In...

CVE-2026-91993

Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different workspaces to enumerate repository...

CVE-2026-91993 Jpom through 2.11.12 Workspace Isolation Bypass via /build/branch-list

Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different workspaces to enumerate repository...

CVE-2026-91993

Jpom through 2.11.12 is affected by a workspace isolation bypass on the /build/branch-list endpoint. The root cause is a failure to validate workspace ownership when resolving a repositoryId , allowing any authenticated user to reference repositories belonging to other workspaces. Attackers can e...

CVE-2026-91993 Jpom through 2.11.12 Workspace Isolation Bypass via /build/branch-list

Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different workspaces to enumerate repository...

CVE-2026-82035 PyMuPDF 1.28.2 Path Traversal via extract_objects() Font Branch

PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extractobjects in src/main.py, where the output filename is constructed by joining a document-controlled BaseFont name directly onto the user-supplied output directory without stripping...

CVE-2026-59960 Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/core

Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUBHEADREF or ARGOSBRANCH can flow through config.branch and getMergeBaseCommitSha when hasRemoteContentAccess is false. The gitFetch and...