CVE-2023-36109

CVE-2023-36109 a poc for cve-2023-36109 request repo git clone https://github.com/jerryscript-project/jerryscript.git cd jerryscript build python ./tools/build.py --clean --debug --compile-flag=-m32 --compile-flag=-fno-omit-frame-pointer --compile-flag=-fno-common --compile-flag=-fsanitize=addres...

Wordlister

Wordlister A simple wordlist generator and mangler written in python 3.10.1. Supported permutations: Capital Upper 1337 Append Prepend Additional functions: Each generated password doesn't contain same word twice. Output can be sorted based on the word length. Preview: usage: wordlister.py -h...

GHSA-MRFP-P49P-3HF2 Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

Summary Pillow's documented PDF append path can spend disproportionate CPU time on a compact malformed PDF page tree. An attacker who can supply an existing PDF to an application that appends an image with Image.save..., format="PDF", append=True can provide a malformed /Pages tree where each lev...

GHSA-F2G6-542V-9J58 Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle

============================================================================ Infinite loop in PdfParser.rewritepages on page tree Parent cycle Location: src/PIL/PdfParser.py:505 in PdfParser.rewritepages Commit: a707c6b21c313880d0771e54965d142dd42358b6...

Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle

============================================================================ Infinite loop in PdfParser.rewritepages on page tree Parent cycle Location: src/PIL/PdfParser.py:505 in PdfParser.rewritepages Commit: a707c6b21c313880d0771e54965d142dd42358b6...

CVE-2026-87864

The curl library is vulnerable to a command injection flaw when using IMAP APPEND commands with CURLOPT_CRLF enabled. The root cause is that curl advertises the raw input byte count in the IMAP APPEND {N} literal while transmitting expanded line-ending data. Consequently, the server reads only $N...

CVE-2026-87864

Enabling "CURLOPTCRLF" causes curl to advertise the raw input byte count in the "IMAP APPEND N" literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands...

CVE-2026-87864

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within...

Red Hat: CVE-2026-87864: curl: IMAP APPEND plus CRLF conversion command injection

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within...

CVE-2026-87864

A flaw was found in curl. When curl is configured to perform carriage return and line feed CRLF conversion during an Internet Message Access Protocol IMAP append operation, it incorrectly reports the raw input size rather than the expanded byte count. Because the receiving server only reads the...

curl: IMAP APPEND plus CRLF conversion command injection

A flaw was found in curl. When curl is configured to perform carriage return and line feed CRLF conversion during an Internet Message Access Protocol IMAP append operation, it incorrectly reports the raw input size rather than the expanded byte count. Because the receiving server only reads the...

IMAP APPEND plus CRLF conversion command injection

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within...

CVE-2026-87864

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within th...

PT-2026-114315

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description Enabling CURLOPT CRLF allows for command injection during IMAP APPEND operations. When transmitting line-ending expanded data, curl advertises the raw input byte count in the IMAP APPEND N...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ipv4: The need to account for “fraggap” on the paged allocation path. In ipAppendData, when the paged-allocation branch is taken, alloclen and pagedlen are calculated as follows: alloclen = fragheaderlen + transhdrlen; pagedlen =...

Astra Linux – Vulnerabilities in Python 2.7, Python 3.11, Python 3.7

When constructing nested elements using XMLDom.minidom methods like appendChild, which rely on clearidcache, the algorithm has a quadratic complexity. This can affect the availability of documents when they are constructed with excessively nested structures...

CVE-2020-11022

Así que así Así que, amigos, CVE-2020-11022 es una vulnerabilidad en jQuery por debajo de la versión 3.5.0 o superior. La vulnerabilidad CVE-2020-11022 en sí misma desencadena un XSS aprovechando la manipulación del DOM como .html, .append, y otras para ejecutar código XSS malicioso. 1. Verificar...

CentOS Linux 8.5 [TuxCare] Security Update: gcc-gdb-plugin / gcc-gfortran / gcc-offload-nvptx / libgcc / etc (CENTOS8.5:CLSA-2025:1744925460)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2025:1744925460 advisory. - In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after...

CentOS Linux 7 [TuxCare] Security Update: gcc / gcc-gnat / libgfortran / libgnat-devel / libitm-devel / etc (CENTOS7:CLSA-2025:1744892170)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1744892170 advisory. - In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after...

AlmaLinux 9.2 [TuxCare] Security Update: cpp / cross-gcc-aarch64 / cross-gcc-c++-aarch64 / gcc / gcc-c++ / etc (ALMALINUX9.2:CLSA-2025:1741290577)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1741290577 advisory. - In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after...