CVE-2019-10149

CVE-2019-10149 CVE-2019-10149 : A flaw was found in Exim versions 4.87 to 4.91 inclusive. Improper validation of recipient address in delivermessage function in /src/deliver.c may lead to remote command execution. Example nc -lvp 9000 python ./CVE-2019-10149/exploit.py --rhost example.com --rport...

OpenSMTPD-CVE-2020-7247-

OpenSMTPD Remote Command Execution Vulnerability CVE-2020-7247 WHS 4th Park Solmin Original link: https://github.com/vulhub/vulhub/blob/43eae7170d09e7748c3aac64cd6a8e5af508a8ef/opensmtpd/CVE-2020-7247/README.md Overview OpenSMTPD is an SMTP server program used on Unix-like operating systems. It c...

CVE-2024-26229-lpe

CVE-2024-26229 CWE-781: Improper Address Validation in IOCTL with METHODNEITHER I/O Control Code in the csc.sys driver...

dirty_sock

dirtysock: Linux Privilege Escalation via snapd In January 2019, current versions of Ubuntu Linux were found to be vulnerable to local privilege escalation due to a bug in the snapd API. This repository contains the original exploit POC, which is being made available for research and education. F...

CVE-2026-6060-QUIC-Handshake-Amplification-via-Address-Validation-Bypass

CVE-2026-6060 – QUIC Handshake Amplification via Address Validation Bypass Program Code Python simulation quicserversim.py - Vulnerable QUIC server simulated handshake import socket def sendquicinitialconn, addr, serversalt: Respond with a large "server hello" without validating source address In...

PT-2026-128116

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: validate packet source for connected sockets virtio transport recv pkt looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback is needed for listeni...

GHSA-JJ36-9PVH-VJ5R Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation

Summary twisted.names.dns.DNSDatagramProtocol, the UDP transport used by twisted's DNS client twisted.names.client.Resolver, createResolver, and anything built on it, including MX lookups in twisted.mail, accepts a DNS response for a pending query solely on the basis of the 16-bit transaction ID...

Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation

Summary twisted.names.dns.DNSDatagramProtocol, the UDP transport used by twisted's DNS client twisted.names.client.Resolver, createResolver, and anything built on it, including MX lookups in twisted.mail, accepts a DNS response for a pending query solely on the basis of the 16-bit transaction ID...

CVE-2026-83813 Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but does not verify that the response came from the queried host...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: usb: asix: validate PHY address before use The ASIX driver reads the PHY address from the USB device via asixreadphyaddr. A malicious or faulty device may return an invalid address = PHYMAXADDR, which causes a warning in...

Astra Linux – vulnerability in Zabbix

The URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL components comply with internet standards...

Astra Linux – vulnerability in ldns

NLnet Labs’ ldns version 1.2.0 up to and including version 1.9.0, when used in applications as a stub resolver over UDP, fails to match the query destination address and port with the response source address and port. Additionally, neither the query ID nor the nature of the query matches that of...

Astra Linux – Vulnerability in Python-Django

A issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. A lack of enforcement of an upper-bound limit on strings passed during IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions cleanipv6address and...

Malicious code in @dransay/address-validation (npm)

Source: ossf-package-analysis 82ababa5637b2f53f5087a161eeba1b6ca6ddba6d31ebb7842614bf0da119fa7 The OpenSSF Package Analysis project identified '@dransay/address-validation' @ 99.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malicious code in @dransay/address-validation (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/ namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using t...

MAL-2026-17668 Malicious code in @dransay/address-validation (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/ namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using t...

Malicious Package

Overview @dransay/address-validation is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: PowerPC: Fixed virtaddrvalid for 64-bit Book3E & 32-bit systems. MPE: On 64-bit Book3E, the vmalloc space starts at 0x8000000000000000. Due to the way pa works, pa0x8000000000000000 returns 0. Therefore,...

CLEANSTART-2026-MP17411 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...

Security vulnerability affects the consul package. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped...

CLEANSTART-2026-ID88447 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...

Security vulnerability affects the kube-state-metrics-fips package. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped...