CVE-2018-0802

CVE-2018-0802 CVE-2018-08022: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0802 MITRE CVE-2018-0802: https://vulners.com/cve/CVE-2018-0802 0patch exploitation and patch video: https://www.youtube.com/watch?v=XU-U4K270Z4 Qihoo 360 blog post...

IPC-Memory-Mac-OSX-Exploit

IPC-Memory-Mac-OSX-Exploit IPC Local Security Bypass Inter Process Communication through shared memory is a concept where two or more process can access the common memory. And communication is done via this shared memory where changes made by one process can be viewed by another process. The kern...

cve-2025-9951-ffmpeg-jp2-poc

CVE-2025-9951 FFmpeg JPEG 2000 Exploitation Research This repository contains two deliberately separated exploitation milestones for the FFmpeg JPEG 2000 component-mapping vulnerability: 1. 01-gdb-assisted/ — the original deterministic GDB-launched PoC and its full research-journey writeup,...

Foxit-Reader-RCE-with-virualalloc-and-shellcode-for-CVE-2018-9948-and-CVE-2018-9958

Custom Exploit : Foxit Reader version 9.0.1.1049 Use After Free with ASLR and DEP bypass on heap My Custom Exploit : Foxit-Reader-RCE-with-virualalloc-and-shellcode-for-CVE-2018-9948-and-CVE-2018-9958 Custom exploit for Win 7 Has space for shellcode My custom ROP chain makes space for shellcode i...

CVE-2013-2028-x64-bypass-ssp-and-pie-PoC

for bypass NX PIE SSP ASLR this poc is not stable. sometimes http service will down. you should fix morecore-offset and chose correct libc-file...

CVE-2025-0282-Full-version

Storks: Remote Code Execution Vulnerability Exploitation Tool Overview Storks is a Python-based Proof-of-Concept PoC tool designed to demonstrate a critical Remote Code Execution RCE vulnerability, identified as CVE-2025-0282 , in a specific network appliance. This vulnerability can be exploited ...

ExecASLR-ekoparty

ExecASLR - Abusing Intel branch predictors to bypass ASLR What is ASLR Address Space Layout Randomization is a mitigation used to make harder to exploit memory corruption attacks. In a scenario of a buffer overflow vulnerability, for example, an attacker that tries to make a Return Oriented...

mariadb-13-rce-lab

MariaDB 13.0.1-rc RCE Lab Remote code execution on the unmodified, stock MariaDB 13.0.1-rc Docker image as uid 999 mysql. Two exploit variants: Variant| File| Requirements| Notes ---|---|---|--- Pure SQL recommended| exploitpuresql.py| a low-priv MariaDB account + TCP| no host access, no docker, ...

how-to-bypass-aslr-on-linux-x86_64

Breaking 64 bit aslr on Linux x86-64 In this article, I'll discuss about the application of the technique described by Samuel Groß in his Remote iPhone Exploitation Part 2: Bringing Light into the Darkness -- a Remote ASLR Bypass, to bypass ASLR on Linux x8664. To show this I'm gonna solve a...

memaddressanalysis

Mem Address Analyzer Research project related to memory address space analysis Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed for Linux by Aidan Marlin, aidan dot marlin at nccgroup dot com Developed for Windows by Nikos Laleas, nikos dot laleas at nccgroup dot com...

CVE-2015-8522.RCE

CVE-2015-8522 The Tivoli FastBack Server 6.1.4 application is vulnerable to a stack-based buffer overflow allowing threat-actors to gain Arbitrary Code Execution ACE via a remote TCP-connection. The PoC provided in this repository leverages this vulnerability to both execute CMD.exe on the target...

CVE-2026-84267 Gvfs: sftp: uninitialized heap disclosure in read_string()

A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause readstring to allocate a buffer with a certain length but the function does not verify that the buffer is completely filled, leaving the remainder of the buffer containing uninitialized heap...

EUVD-2026-69296

A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause readstring to allocate a buffer with a certain length but the function does not verify that the buffer is completely filled, leaving the remainder of the buffer containing uninitialized heap...

CVE-2026-84267 Gvfs: sftp: uninitialized heap disclosure in read_string()

A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause readstring to allocate a buffer with a certain length but the function does not verify that the buffer is completely filled, leaving the remainder of the buffer containing uninitialized heap...

CVE-2026-84267

A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause readstring to allocate a buffer with a certain length but the function does not verify that the buffer is completely filled, leaving the remainder of the buffer containing uninitialized heap...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in XML in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially perform an ASLR bypass via a crafted HTML page. Chromium security severity: Low...

CVE-2026-74339

A flaw was found in the ALSA Advanced Linux Sound Architecture sequencer component of the Linux kernel. A local attacker, by writing a direct variable event to itself, can read back a kernel memory address from the returned event header. This information disclosure could potentially be used to...

Exploit for CVE-2026-14669

CVE-2026-14669 - PostgreSQL tochar Time Zone Abbreviation H...

Important: libssh2

Issue Overview: libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftpopen function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSHFXPOPEN with...

SUSE CVE-2026-71391

GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfntvarysimpleglyph and sfntvarycompoundglyph uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font ...