fisy-fuzz

FIle SYstem - FUZZer これは、2020年4月に開催されたHack in the Box 2020 Lockdown Editionカンファレンスで発表した、完全なファイルシステムファジングフレームワークです。 カンファレンストーク カンファレンストーク（単一動画） カンファレンス資料 目標...

cirro-azcli-ext

cirro-azcli-ext 一个 Azure CLI 扩展，用于被动收集 Azure 资源数据到与 Cirro https://github.com/bishopfox/cirro 架构兼容的 SQLite 数据库中。它还会将所有 CLI 调用记录到一个 JSON-lines 文件中。 挂接到 knack 事件： EVENTINVOKERPOSTPARSEARGS — 记录命令参数 EVENTINVOKERFILTERRESULT — 将资源数据写入 SQLite 设置 1. 安装扩展 az extension add --source dist/cirroazcliext-.whl...

CVE-2024-2961

CVE-2024-2961 CVE-2024–2961 セキュリティ問題緩和スクリプト 説明 このリポジトリには、GNU libc glibc バージョン 2.39 以前で特定されたバッファオーバーフローの脆弱性（CVE-2024-2961 として知られる）を確認および緩和する Bash スクリプトが含まれています。この脆弱性は、iconv 関数を使用してリクエストのエンコーディングを特定の中国語拡張エンコーディング（ISO-2022-CN-EXT）との間で変換する際に PHP に影響を与えます。悪用された場合、広範囲にわたる影響を与える可能性があります。 使用方法 前提条件...

e-is-for-exploit-cve-2026-17543-php-pgsql-sql-injection-backslash-breakout

CVE-2026-17543 — PHP ext/pgsql 中通过 E'...' 反斜杠突破的 SQL 注入 CVE-2026-17543 （CVSS 9.8 严重，CWE-89）的概念验证，这是 PHP 过程化 PostgreSQL 扩展中的一个 SQL 注入漏洞。 漏洞概述 pginsert、pgselect、pgupdate、pgdelete 和 pgconvert 都会将字符串值传递给 phppgsqlconvert 处理，该函数： 1. 转义 ：使用 libpq 的 PQescapeStringConn 对值进行转义 —— 在 standardconformingstring...

CVE-2016-5195

记录仅以学习为目的，禁止用于非法用途 原理 该漏洞的原理是依靠并发刷写脏页，使原本只读权限的文件内容发生变更 如果被修改的文件为root所属且具备SUID权限，那么就可以利用其进行提权 影响范围 在2016年10月前被编译的且版本在2.6.22 到 4.8.3之间的内核，因为2016年10月后的大概率被打补丁了 务必是Ext文件系统，如果是XFS文件系统，就会触发xfs只读页断言，而后系统重启，变成DDos攻击了 工具代码（dirtycowfilepayload.c） include include include include include include include...

CVE-2026-6951

CVE-2026-6951 Ejecución Remota de Código en simple-git ★ CVE-2026-6951 PoC de RCE por Bypass del Filtro de la Opción --config de simple-git ★ https://github.com/user-attachments/assets/4c992530-c5bb-4ff4-be5d-af0857eebb67 Descripción general CVE-2026-6951 es una vulnerabilidad de ejecución remota...

PT-2026-106548

In the Linux kernel, the following vulnerability has been resolved: sched ext: Close the pre-enable ops error claim window scx alloc and add sched publishes ops-priv before scx root enable workfn switches the state to SCX ENABLING. An error claimed via scx bpf error bstr from an associated BPF...

PT-2026-106518

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RX buffer OOB-write in wilc wlan handle isr ext wilc wlan handle isr ext takes the RX transfer size from the device-reported interrupt status register a 15-bit field shifted left by 2, up to 131068 bytes and...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ext4: Make sure the first directory block is not a hole. The syzbot constructs a directory that has no dirblock, but it is not inline; in other words, the first directory block is a hole. No errors are reported when creating file...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: a potential memory leak has been fixed in ext4fcrecordregions. Since krealloc may return NULL, in this case, state-fcregions may not be freed by krealloc. However, state-fcregions is already set to NULL. This could lead to ...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: sparc: Fixed inaccurate exception reporting in copyfromtouser for UltraSPARC III. Anthony Yznaga discovered that a bug in the ext4 code, where large amounts of data were allowed, resulted from copyfromuser returning impossibly...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ext4: use of a stale path after allocation in ext4extinsertextent As Ojaswin mentioned in the link, in ext4extinsertextent, if the path is reallocated during ext4extcreatenewleaf, we will use a stale path, leading to a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ACPICA: fixed cache leaks in “acpiparse” and “parseext”. ACPICA commit: 8829e70e1360c81e7a5a901b5d4f48330e021ea5 The actual ACPI cache leak points are as follows: 0.360101 ACPI: Added OSIModule Device 0.360101 ACPI: Added...

SSH-Terrapin-Prefix-Truncation-Weakness-CVE-2023-48795-Checker

terrapincheck.py 軽量なPythonスキャナです。CVE-2023-48795 — SSH Terrapin プレフィックス切り詰め脆弱性のための。 Terrapin はSSHにおけるプロトコルレベルの脆弱性で、アクティブなMitM攻撃者がネゴシエーションされた拡張情報を切り詰め、接続のセキュリティを低下させることができます。特に致命的なのはext-info（サーバ署名アルゴリズムに使用）とping（OpenSSHのno-auth拡張で使用）を無効化することです。 📋 目次 脆弱性について 動作の仕組み 要件 インストール 使用方法 出力 脆弱な条件 修復方法 免責事項...

BIT-PHP-MIN-2026-91767 Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN

phpopensslmatcheswildcardname in ext/openssl/xpssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP...

BIT-PHP-2026-91767 Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN

phpopensslmatcheswildcardname in ext/openssl/xpssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP...

BIT-LIBPHP-2026-91767 Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN

phpopensslmatcheswildcardname in ext/openssl/xpssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP...

PT-2026-105116

php openssl matches wildcard name in ext/openssl/xp ssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes th...

Rocky Linux 10.2 [CIQ] Security Update: php8.4 / php8.4-bcmath / php8.4-bcmath-debuginfo / php8.4-cli / etc Multiple Vulnerabilities (crlsa-2026_56969)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202656969 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Arbitrary code execution via out-of-bounds write in bccomp...

Rocky Linux 9 [CIQ] Security Update: apcu-panel / php / php-bcmath / php-bcmath-debuginfo / php-cli / etc Multiple Vulnerabilities (crlsa-2026_57539)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202657539 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives...