idb

Idb idb is a tool to simplify some common tasks for iOS pentesting and research. Originally there was a command line version of the tool, but it is no longer under development so you should get the GUI version. idb has a new homepage athttp://www.idbtool.com All documentation and news are posted...

CVE-2024-42642

CVE-2024-42642 Introduction The device in question is any MX500-series SSD. These SSDs are controlled by a Sillicon-Motion SM2259 controller older batches had an older controller, Sillicon-Motion SM2258, but the main focus of this document is the newer one. SM2259 is a 4-channel SATA 6Gb/s...

ARC-Browser-Address-Bar-Spoofing-PoC

ARC Browser Address Bar Spoofing - iOS/iPadOS CVE-2024-25733 ARC Browser Address Bar Spoofing PoC - iOS/iPadOS Exploit PoC Proof of Concept function spoof setTimeout = window.stop; let randomPort; do randomPort = Math.floorMath.random 1000; while randomPort === 0 || randomPort === 443;...

CVE-2023-31443

CVE-2023-31443 nordugrid-arc-wn 6.14.0 DoS/LPE. Suggested description NorduGrid nordugrid-arc-wn 6.14.0 has the arc-job-cgroup SUID binary that is vulnerable to a path traversal attack. Combined with a race condition, the attacker can write the ppid to any file as long as the file is writable by...

npm: Forge: ASN.1 OID first arc truncation in asn1.oidToDer

npm: Forge: ASN.1 OID first arc truncation in asn1.oidToDer vulnerability discovered by ? in WordPress npm node-forge versions = 1.4.0...

CVE-2026-55098 Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, alloweddirectories uses...

CVE-2026-55098

The Arc time-series database contains a cross-database authorization bypass in versions prior to 26.06.2 . The vulnerability stems from an incomplete denylist in userSQLReadParquetPattern that fails to block specific DuckDB table-valued I/O functions such as parquet_scan, glob, parquet_metadata, ...

EUVD-2026-114443

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, alloweddirectories uses...

CVE-2026-55098: Basekick-Labs arc: Arc is an open, SQL-native time-series database for telemetry

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, alloweddirectories uses...

CVE-2026-118775 Forge: ASN.1 OID first arc truncation in asn1.oidToDer

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encod...

J4Care dcm4chee-arc-light resource management error vulnerability

The J4Care dcm4chee-arc-light version 5.35.1 has a resource management vulnerability. This vulnerability stems from the JPEGParser entering an infinite loop when parsing specially crafted or truncated streams, which may lead to a denial-of-service attack...

J4Care dcm4chee-arc-light authorization issue vulnerability

The J4Care dcm4chee-arc-light version 5.35.1 has an authorization issue vulnerability. This vulnerability stems from improper access control in the storage status-change REST service. It allows changing location records that are still associated with DICOM instances to states like TODELETE,...

J4Care dcm4chee-arc-light authorization issue vulnerability

The J4Care dcm4chee-arc-light version 5.35.1 has an authorization issue vulnerability. This vulnerability arises from the default configuration, where the HL7 listener accepts ADT^A40 patient merge messages without authenticating the sending application. This allows remote senders to reassign...

J4Care dcm4chee-arc-light resource management error vulnerability

The J4Care dcm4chee-arc-light version 5.35.1 has a resource management vulnerability. This vulnerability arises from MP4Parser not properly verifying the size of the MP4 box. Abnormal boxes may cause the parsing process to stop and repeatedly process the same input, leading to a denial-of-service...

J4Care dcm4chee-arc-light resource management error vulnerability

The J4Care dcm4chee-arc-light version 5.35.1 has a resource management vulnerability. This vulnerability stems from inefficient boundary matching and unnecessary buffer copying performed by MultipartInputStream. The specially crafted multipart inputs can force excessive boundary comparisons and...

J4Care dcm4chee-arc-light authorization issue vulnerability

J4Care dcm4chee-arc-light version 5.35.1 has an authorization issue vulnerability. This vulnerability stems from the default configuration, where archives accept DICOM images from unregistered call AEs. Remotepartner can use C-FIND and C-GET commands to enumerate and retrieve patient information...

Astra Linux – vulnerability in rustc

In the standard library of Rust prior to version 1.29.0, there is weak synchronization in the Arc::getmut method. This synchronization issue can lead to memory safety problems via race conditions...

Astra Linux – vulnerability in linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ARC: mm: fix leakage of memory allocated for PTE Since commit d9820ff “ARC: mm: switch pgtablet back to struct page ”, a memory leakage issue occurs. Memory allocated for page table entries is not released during process...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: net: arc: fix the device for dmamapsingle/dmaunmapsingle ndev-dev and pdev-dev are not the same device; use ndev-dev.parent which has dmamask. ndev-dev.parent is simply pdev-dev. Otherwise, this would cause the following issue:...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: arc: emac: quiesce interrupts before requesting IRQ Normal RX/TX interrupts are enabled later, in arcemacopen, so the probe should not see interrupt delivery in the usual case. However, hardware may still present...