ColdFusionPwn

ColdFusionPwn Exploitation Tool for CVE-2017-3066 targeting Adobe Coldfusion 11/12. Description The tool allows you to generate serialized AMF-payloads to exploit the missing input validation of allowed classes. For details see our blog post. Install Get the latest version of ysoserial. Get...

AMFDSer-ngng

AMFDSer-ngng A Burp Extender plugin, that will take deserialized AMF objects and encode them in XML using the Xtream library. Based on the original work of Khai Tran, all hail https://blog.netspi.com/ AMFDSer-ngng also utilizes part of Kenneth Hill's Jmeter source code for custom AMF...

coldfusion-amf

coldfusion-amf Coldfusion AMF PWN pwn http://localhost "nslookup burpcollab.net"...

CVE-2025-29632

Author: HanyiLuo, Yuqi Huo CVE-2025-29632 the information for the vulnerability covered by CVE-2025-29632 Affected versions: 4.0.0 and previous versions When free5gc processes the InitialUEMessage, it only checks whether the nASPDU reference is nil i.e., whether it is a null pointer, but does not...

CVE-2020-2950

Oracle-BI CVE-2020-2950 AMF deseiralize Version: 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 Install:https://www.sql.edu.vn/obiee/oracle-business-intelligence-12c/ Ref: https://peterjson.medium.com/cve-2020-2950-turning-amf-deserialize-bug-to-java-deserialize-bug-2984a8542b6f Exploit - PoC amf.bin Header c...

CVE-2017-3066

CVE-2017-3066 Description Adobe ColdFusion uses message format the Action AMF. The AMF Protocol is a custom binary serialization Protocol. It has two formats: AMF0 and AMF3. Action message consists of headers and bodies. There are several implementations of AMF in different languages. For Java we...

CVE-2026-112061

A flaw was found in rtmpdump. This vulnerability allows a remote attacker, acting as a malicious server or intercepting network traffic, to cause a Denial of Service DoS. By sending a specially crafted Action Message Format AMF payload with truncated array data, the attacker triggers a heap-based...

CVE-2026-117069

An integer truncation vulnerability in the NAS decoder of OpenAirInterface OAI CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service DoS via crafted NAS Registration Requests containing a malformed IMEISV in the 5GS Mobile Identity IE. The Type6NasIe::Validate...

CVE-2026-117067

An out-of-bounds memory access vulnerability in the N2 SCTP interface of OpenAirInterface OAI CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service DoS by repeatedly establishing SCTP associations, resulting in a process crash due to improper file descriptor bound...

CVE-2026-117068

An integer underflow vulnerability in the NAS decoder of OpenAirInterface OAI CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service DoS via crafted NAS Registration Requests containing a truncated SUCI in the 5GS Mobile Identity IE. Insufficient length validation ...

CVE-2026-117069: n/a: An integer truncation vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an…

An integer truncation vulnerability in the NAS decoder of OpenAirInterface OAI CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service DoS via crafted NAS Registration Requests containing a malformed IMEISV in the 5GS Mobile Identity IE. The Type6NasIe::Validate...

PT-2026-135638

Name of the Vulnerable Software and Affected Versions OpenAirInterface OAI CN5G AMF version 2.2.1 Description An integer truncation issue exists in the NAS decoder. An unauthenticated remote attacker can trigger a denial of service by sending crafted NAS Registration Requests containing a malform...

EUVD-2026-115356

An integer underflow vulnerability in the NAS decoder of OpenAirInterface OAI CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service DoS via crafted NAS Registration Requests containing a truncated SUCI in the 5GS Mobile Identity IE. Insufficient length validation ...

CVE-2026-117068: n/a: An integer underflow vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an…

An integer underflow vulnerability in the NAS decoder of OpenAirInterface OAI CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service DoS via crafted NAS Registration Requests containing a truncated SUCI in the 5GS Mobile Identity IE. Insufficient length validation ...

CVE-2026-117068

An integer underflow vulnerability in the NAS decoder of OpenAirInterface OAI CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service DoS via crafted NAS Registration Requests containing a truncated SUCI in the 5GS Mobile Identity IE. Insufficient length validation ...

CVE-2026-117067

The OpenAirInterface (OAI) CN5G AMF v2.2.1 software is susceptible to an out-of-bounds memory access vulnerability within the N2 SCTP interface . The root cause is improper file descriptor bounds checking during the FD_SET() operation. An unauthenticated remote attacker can exploit this by repeat...

EUVD-2026-115382

An integer truncation vulnerability in the NAS decoder of OpenAirInterface OAI CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service DoS via crafted NAS Registration Requests containing a malformed IMEISV in the 5GS Mobile Identity IE. The Type6NasIe::Validate...

CVE-2026-117067

An out-of-bounds memory access vulnerability in the N2 SCTP interface of OpenAirInterface OAI CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service DoS by repeatedly establishing SCTP associations, resulting in a process crash due to improper file descriptor bound...

CVE-2026-117068

The OpenAirInterface (OAI) CN5G AMF version 2.2.1 is vulnerable to an integer underflow in the NAS decoder. The root cause is insufficient length validation within the DecodeSuci() function, which allows an unauthenticated remote attacker to trigger an out-of-bounds heap read by sending a crafted...

EUVD-2026-115355

An out-of-bounds memory access vulnerability in the N2 SCTP interface of OpenAirInterface OAI CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service DoS by repeatedly establishing SCTP associations, resulting in a process crash due to improper file descriptor bound...