CentOS Linux 6 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / nginx-mod-http-geoip / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1776791510)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1776791510 advisory. - Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module...

AlmaLinux 9.2 [TuxCare] Security Update: mod_http2 Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1762784415)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1762784415 advisory. - HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413...

AlmaLinux 9.2 [TuxCare] Security Update: mod_http2 (ALMALINUX9.2:CLSA-2026:1778873714)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778873714 advisory. - When a HTTP/2 stream was reset RST frame by a client, there was a time window were the request's memory resources were not reclaimed...

Rocky Linux 9.6 [TuxCare] Security Update: mod_http2 (ALMALINUX9.6:CLSA-2026:1781259837)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781259837 advisory. - Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP...

Linux Distros Unpatched Vulnerability : CVE-2026-101901

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a...

AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.2:CLSA-2025:1752922753)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1752922753 advisory. - An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2...

AlmaLinux 9.2 [TuxCare] Security Update: golang / golang-bin / golang-docs / golang-misc / golang-race / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1748002217)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1748002217 advisory. - Using go get to fetch a module with the .git suffix may unexpectedly fallback to the insecure git:// protocol if the module is...

SUSE CVE-2026-101898

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb ★ CVE-2026-49975 HTTP/2 Bomb PoC ★ Overview CVE-2026-49975 is a Denial of Service DoS vulnerability in Apache HTTP Server. The vulnerability occurs in the HTTP/2 request handling path, where multiple cookie header fields can be merged without being properly counted...

cve-2019-2215_SH-M08

2019 年 10 月より前のセキュリティパッチが当たった Android 端末で root 権限を取得する概念実証コードの AQUOS sense 2SH-M08移植版です。 動作環境 以下の OS バージョンで動作を確認しています。他のバージョンや他の機種で動かす場合は「移植方法」の章に従って移植してください。 ro.build.date: 2019年 3月 20日 水曜日 04:58:03 JST ro.build.description: Anasui-user 8.1.0 S3200 01.00.02 release-keys ro.build.display.id:...

CVE-2013-3651

CVE-2013-3651 PoC - EC-CUBE 2 Using Require Python 3 Exec $ python poccve20133651.py - e.g. $ python poccve20133651.py http://127.0.0.1:9000/ Result: Vulnerable! PoC 脆弱性 | ECサイト構築・リニューアルは「ECオープンプラットフォームEC-CUBE」 https://www.ec-cube.net/info/weakness/weakness.php?id=49 Reference JVNDB-2013-000062 -...

network-security-lab

🔬 Network Security Lab A controlled virtual environment simulating real-world attack and defense scenarios 📋 Overview This lab simulates a real-world penetration test and defensive hardening exercise in a fully isolated virtual environment. It demonstrates the full offensive security lifecycle —...

CVE-2026-42772 Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC

Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC pee...

CVE-2026-42772 Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC

Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC pee...

CVE-2026-42772 Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC

Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC pee...

CVE-2026-42772

A flaw in OpenSSL allows a remote attacker to cause a Denial of Service (DoS) by exploiting an inefficient QUIC stream reassembly algorithm. When packets arrive out of order, the software falls back to a head-to-tail linear search for fragments in a doubly-linked list. By manipulating sequence of...

Hardware-Vulnerability-with-Proof-of-Concept-

🛡️ Spectre Variant 2 CVE-2017-5715 — ハードウェア脆弱性研究 最新CPUにおける投機的実行攻撃を探求する、詳細な研究論文と実践的なProof of Concept（PoC） 📖 概要 このプロジェクトは、投機的実行と分岐予測を実装したCPUに影響を与えるハードウェアレベルのサイドチャネル脆弱性である Spectre Variant 2（CVE-2017-5715） （別名 Branch Target Injection ）に関する研究およびラボベースの探求です。 このプロジェクトの目的は次のとおりです： Spectre Variant...

web-penetration-drupal

Webペネトレーションテスト — Drupal CVE-2018-7600 種類: インターンシッププロジェクト | 企業: BB CyberSec | 期間: 2024年11月 – 2025年1月 📋 プロジェクト概要 本プロジェクトは、BB CyberSecでのサイバーセキュリティインターンシップの一環として実施した、Drupal Webアプリケーションの完全なペネトレーションテストを文書化したものです。評価は、Drupal coreに影響を与える重大な脆弱性 CVE-2018-7600 （Drupalgeddon 2）の特定と悪用に焦点を当てました。 🎯 目的...

CVE-2021-44228

🚨 CVE-2021-44228 — 「Log4Shell」 Apache Log4j 2 における深刻なリモートコード実行の脆弱性であり、広く Log4Shell として知られています。 📖 目次 概要 技術的詳細 深刻度とCVSS 影響を受けるバージョン 悪用と影響 実際の影響 検出 対策と修正 まとめ 🔎 概要 CVE-2021-44228 は、2021年12月に発見された Apache Log4j 2.x （2.15.0 未満）における深刻なRCE脆弱性です。 この脆弱性により、認証されていないリモート攻撃者が、Log4j...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...