witchcraft

🎉 Your OPSEC companion. Run witchcraft help or witchcraft manual for the complete manual 🎉 What it does? WITCHCRAFT Are much more than a simple alias, it's a init system that can works with busybox, a shell and automation's and automation's engine for hacking, osint, forensics, etc. NAME witchcra...

research

Security Research Repository dedicated to my security vulnerability discoveries CVEs. This repository contains detailed technical documentation, proof-of-concept exploits, and analysis of discovered vulnerabilities. About This repository aggregates all CVEs I have discovered and researched,...

ROOT-OS-ALPINE-317-CVE-2022-48174 CVE-2022-48174 in busybox - Patched by Root

Root has patched CVE-2022-48174 in the busybox package for Root:Alpine:3.17. Multiple fixed versions available...

ROOT-OS-ALPINE-315-CVE-2022-48174 CVE-2022-48174 in busybox - Patched by Root

Root has patched CVE-2022-48174 in the busybox package for Root:Alpine:3.15. Multiple fixed versions available...

CVE-2025-60876

CVE-2025-60876: busybox wget request-target injection fix A behavior-preserving fix for CVE-2025-60876, an HTTP header-injection vulnerability in BusyBox wget, plus the proof-of-concept that demonstrates it and the artifacts for submitting the fix upstream to BusyBox. The vulnerability BusyBox wg...

CVE-2014-0196

See https://vulners.com/cve/CVE-2014-0196...

Linux Distros Unpatched Vulnerability : CVE-2026-88841

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - busybox - None CVE-2026-88841 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, In...

busybox: busybox: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...

busybox: busybox: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb packages

BusyBox dpkg readpackagefield steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: busybox: busybox-1.37.0-9.1.hum1 aarch64, x8664 busybox-petitboot-1.37.0-9.1.hum1 aarch64, x8664 busybox-shared-1.37.0-9.1.hum1 aarch64, x8664 busybox-1.37.0-9.1.hum1.src src Security Fixes:...

busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint

BusyBox passwd/group tokenize references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers...

busybox: busybox: romfs volume ID parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images...

busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

Linux Distros Unpatched Vulnerability : CVE-2026-88831

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients. CVE-2026-88831 No...

Linux Distros Unpatched Vulnerability : CVE-2026-88835

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox dpkg readpackagefield steps past a NUL terminator on malformed .deb packages, causing an out- of-bounds heap read. CVE-2026-88835 Note that Nessus relie...

Linux Distros Unpatched Vulnerability : CVE-2026-88830

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-88837

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check. CVE-2026-88837 Note that Nessus...

Linux Distros Unpatched Vulnerability : CVE-2026-88840

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox TLS getclienthello reads past the end of the input buffer when parsing a truncated ClientHello message. CVE-2026-88840 Note that Nessus relies on the...

Linux Distros Unpatched Vulnerability : CVE-2026-88832

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images...

Linux Distros Unpatched Vulnerability : CVE-2026-88839

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox passwd/group tokenize references a stale endpoint pointer after trimming, causing an out-of- bounds write of heap pointers. CVE-2026-88839 Note that...