CVE-2026-90610

A vulnerability was found in GPAC up to f1219cde. This affects the function gfsvgattributescopy of the file scenegraph/svgattributes.c of the component MP4Box. Performing a manipulation results in buffer over-read. The attack is only possible with local access. The exploit has been made public an...

heartpatch.us

heartpatch.us 正在建设中 修补全球万维网服务器上的 Heartbleed OpenSSL 漏洞。 背景 Heartbleed 是 OpenSSL 加密库中的一个安全漏洞，该库是传输层安全（TLS）协议的一种广泛使用的实现。该漏洞于2012年被引入软件，并于2014年4月公开披露。无论易受攻击的 OpenSSL 实例是作为 TLS 服务器还是客户端运行，Heartbleed 都可能被利用。它源于 TLS 心跳扩展实现中的输入验证不当（由于缺少边界检查）。因此，漏洞的名称来源于心跳。该漏洞被归类为缓冲区过度读取，即读取的数据量超过允许范围的情况。 电子前沿基金会、Ars...

heartbleed

Heartbleed 漏洞 场景描述 Heartbleed 漏洞是一种网络安全攻击示例，它利用了 OpenSSL 库中的漏洞。简单来说，OpenSSL 库中缺少一个验证步骤，可能允许黑客访问使用该漏洞库的服务器上的敏感信息。作为客户端和服务器之间建立 SSL 连接握手协议的一部分，客户端会发送一条 心跳 消息，然后服务器会将其回显。客户端还需要发送其心跳消息的长度，服务器据此确定需要从内存中返回的字节数。一个虚假的长度值（服务器未验证）可能导致其返回客户端心跳消息存储位置相邻的内存字节。 本仓库演示了如何利用 Heartbleed 漏洞从 Web 服务器中提取会话...

vucsa

易受攻击的客户端-服务器应用程序 VuCSA 易受攻击的客户端-服务器应用程序 VuCSA 旨在学习/展示如何对非HTTP客户端-服务器应用程序执行渗透测试。它使用 Java（以及 JavaFX 图形用户界面）编写。 目前，该易受攻击的应用程序包含以下挑战： 1. 缓冲区过度读取（模拟） 2. 命令执行 3. SQL注入 4. 枚举 5. XML 6. 水平访问控制 7. 垂直访问控制 8. RCE反序列化 如果你想了解如何解决这些挑战，请查看 PETEP 网站，其中描述了如何使用开源工具 PETEP 来利用它们。 提示 1：...

heartbleed-proof-of-concept

Heartbleed CVE-2014-0160 环境搭建 你需要 docker 才能完成环境搭建。 该漏洞利用程序会从 Client Hello 消息中动态生成随机字节，因此在构建可执行文件时需要链接该库。 为了正确链接，需要安装以下软件包： root@kitploit: sudo apt-get install libssl-dev 该工具已在 Docker for Desktop - Version: 20.10.21 （搭配 WSL 2 ）上测试通过。 复现该漏洞的步骤如下： 1. 初始化存在漏洞的服务器 root@kitploit: cd server-image/ docke...

CVE-2026-38332

TinyEXIF before 1.1.0 is affected by a heap-based buffer over-read in the EntryParser::Fetch methods, triggered via a crafted SubjectArea length in EXIF data. The vulnerability carries a CVSS 3.1 score of 2.9 (LOW) with a local attack vector, high complexity, no privileges required, and a low ava...

EUVD-2026-77112

TinyEXIF before 1.1.0 has a heap-based buffer over-read in EntryParser::Fetch methods reachable via a crafted SubjectArea length...

CVE-2021-40154

CVE-2021-40154 LPC55S69 和 K82 USB 系统内编程 ISP 缓冲区过度读取漏洞 用于测试在 LPC55S69 和 K82 系列 Revision A2 中发现的 BootROM 漏洞的 POC。该漏洞已在更新的设备中修复，LPC55S69 使用新的 Revision A3。 受影响设备： 已确认： LPC55S69 和 K82 系列 MCU 疑似： 其他具有类似 USB ISP 堆栈的 NXP 系列 MCU——Kinetis K 系列和 RT 系列 漏洞概要： 在 NXP LPC55s69 和 Kinetis K82 微控制器系列的 USB 系统内编程 ISP...

CVE-2019-19204

CVE-2019-19204 在 Oniguruma 6.x（6.9.4rc2 之前版本）中发现了一个问题。在 regparse.c 的 fetchintervalquantifier（原名为 fetchrangequantifier）函数中，调用 PFETCH 时未检查 PEND。这会导致基于堆的缓冲区过度读取。 研究人员：ManhND of The Tarantula Team, VinCSS（Vingroup 成员） 什么是 Oniguruma Oniguruma 由 K. Kosako 开发，是一个采用 BSD 许可的正则表达式库，支持多种字符编码。Ruby 编程语言（1.9...

Linux Distros Unpatched Vulnerability : CVE-2026-89588

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ACPI: APEI: GHES: fix ARM section length accounting after header In gheshandlearmhwerror, after skipping the cpersecprocarm header with err + 1, the remaining...

Linux Distros Unpatched Vulnerability : CVE-2026-89608

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ecryptfs: pass packet set buffer size to parser ecryptfsparsepacketset receives a pointer into the file header, but it calculates the remaining packet buffer si...

CVE-2026-80933

A flaw was found in the Linux kernel's mt76: mt7996 Wi-Fi driver. This vulnerability occurs because the driver does not properly validate the size of the default EEPROM Electrically Erasable Programmable Read-Only Memory firmware. A specially crafted, truncated EEPROM firmware file can cause the...

AZL-100728 CVE-2026-89526 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdrcountreadsegments checks only 4-byte alignment;...

CVE-2026-89466

In the Linux kernel, the following vulnerability has been resolved: power: supply: qcombattmgr: terminate the strings from firmware The qcombattmgrsc8280xpstrcpy takes a Pascal-style string when the firmware sends one. Otherwise it copies all BATTMGRSTRINGLEN bytes and leaves the destination...

AZL-100734 CVE-2026-80933 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during...

CVE-2026-89608

CVE-2026-89608 affects the ecryptfs component of the Linux kernel. The function ecryptfs_parse_packet_set() calculates the remaining packet buffer size from PAGE_SIZE - 8 instead of the actual packet set buffer length, which can overstate the available buffer for version 1 headers . According to ...

CVE-2026-89588 ACPI: APEI: GHES: fix ARM section length accounting after header

In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix ARM section length accounting after header In gheshandlearmhwerror, after skipping the cpersecprocarm header with err + 1, the remaining length was reduced by sizeoferr pointer size instead of sizeoferr...

CVE-2026-89466 power: supply: qcom_battmgr: terminate the strings from firmware

In the Linux kernel, the following vulnerability has been resolved: power: supply: qcombattmgr: terminate the strings from firmware The qcombattmgrsc8280xpstrcpy takes a Pascal-style string when the firmware sends one. Otherwise it copies all BATTMGRSTRINGLEN bytes and leaves the destination...

EUVD-2026-76372

In the Linux kernel, the following vulnerability has been resolved: power: supply: qcombattmgr: terminate the strings from firmware The qcombattmgrsc8280xpstrcpy takes a Pascal-style string when the firmware sends one. Otherwise it copies all BATTMGRSTRINGLEN bytes and leaves the destination...

CVE-2026-80933

This Linux kernel vulnerability affects the mt76: mt7996 Wi-Fi driver . The driver parses and copies the default EEPROM firmware without validating its length, so a truncated firmware file can cause the driver to read beyond the allocated buffer during variant validation or the fallback copy. Red...