nginx-rift-detect

nginx-rift-detect Script de detección por comportamiento para CVE-2026-42945 NGINX Rift — un desbordamiento de búfer en el montón en ngxhttprewritemodule presente en nginx desde 2008. ⚠️ Descargo de responsabilidad Esta herramienta está destinada exclusivamente a pruebas de seguridad e...

CVE-2026-42945

CVE-2026-42945 Nginx Rift - Kit de Prueba de Concepto PoC Un kit completo de prueba de concepto para CVE-2026-42945 Nginx Rift, una vulnerabilidad crítica de desbordamiento de búfer en el montón en el módulo ngxhttprewritemodule de Nginx. Resumen de la Vulnerabilidad Campo| Detalles ---|--- ID CV...

lab-cve-2023-4863

CVE-2023-4863 — libwebp 漏洞利用实验室 在完全隔离且自动化的 Docker 环境中复现 CVE-2023-4863（libwebp 堆缓冲区溢出）。基于 CEFIRE 的道德黑客模块实践。 本实验室功能 在私有网络中启动八个容器： 容器| 角色 ---|--- attacker| 使用 craft.c 生成 exploit.webp，并通过 HTTP 提供该文件以及一个模拟钓鱼页面 victim-cli| Ubuntu 22.04，带 libwebp 1.2.2-2ubuntu0.22.04.1（有漏洞版本）。自动下载并处理该漏洞利用文件 → 崩溃...

Important: Red Hat Security Advisory: libvirt security, bug fix, and enhancement update

An update for libvirt is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow

A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer...

CVE-2023-21716-Analysis-ICT287

CVE-2023-21716 分析-ICT287：Microsoft Word 远程代码执行 概述 此仓库记录了对 CVE-2023-21716 的分析与复现过程，该漏洞是 Microsoft Word 的 RTF 解析器中的堆缓冲区溢出漏洞，CVSS 评分为 9.8（严重）。 内容说明 文件| 描述 ---|--- CVE-2023-21716AnalysisReport.pdf| 完整的技术分析报告，包含漏洞解释、影响评估、虚拟机搭建指南及漏洞利用演示截图 主要发现 根本原因 ：wwlib.dll 在解析包含过多字体 ID（\f）的 \fonttbl 时，边界检查不充分。 影响...

FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can exploit a heap-based buffer overflow vulnerability in the negosendnegotiationrequest function. By sending a specially crafted Server Redirection PDU message with an attacker-controlled LoadBalanceInfo field, the serve...

Important: Red Hat Security Advisory: freerdp security update

An update for freerdp is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption.

A flaw was found in FreeRDP. A malicious RDP Remote Desktop Protocol server or a man-in-the-middle attacker could exploit a heap buffer overflow vulnerability during connection negotiation, prior to authentication. By sending a specially crafted Server Redirection PDU Protocol Data Unit with an...

CVE-2022-27666

CVE-2022-27666 Linux 内核 IPsec ESP6 实现中的堆缓冲区溢出（linux 5.13.19）。 环境搭建（假设为 root 用户） 1. 构建内核（在虚拟机内） 安装依赖： apt update && apt install -y \ build-essential bc bison flex \ libssl-dev libelf-dev libncurses-dev \ dwarves pahole gcc make wget xz-utils git python3 libfuse3-dev 下载并解压： cd /home/ubuntu/ wget...

Important: Red Hat Security Advisory: librabbitmq security update

An update for librabbitmq is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

rabbitmq-c: rabbitmq-c: Heap buffer overflow leading to denial of service

A flaw was found in rabbitmq-c. A malicious AMQP Advanced Message Queuing Protocol server or an on-path attacker can send an undersized frame size during the login handshake. This can lead to a heap buffer overflow, causing memory corruption and potentially a denial of service. Code execution is...

gimp: integer overflow when generating a thumbnail preview for a PSD file

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD Photoshop Document image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a...

AlmaLinux 9.2 [TuxCare] Security Update: expat / expat-devel / expat-static (ALMALINUX9.2:CLSA-2026:1791196479)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791196479 advisory. - libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expatrealloc function on 32-bit platforms when computing...

PT-2026-106159

In cfg2prop of btif storage.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58835: Heap-based Buffer Overflow

In cfg2prop of btifstorage.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

Fedora 45 : nagios-plugins (2026-c213ad9471)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-c213ad9471 advisory. Update to upstream bz2453492 checkicmp: host-count overflow leads to heap buffer overflow bz2513957 Update 0012-fix-perl-ntp-ipv6.patch to allow uppercase...

AlmaLinux 9 : libvirt (ALSA-2026:74424)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:74424 advisory. libvirt: swtpm privilege escalation via symlink following CVE-2026-63622 libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer...

RHEL 10 : libvirt (RHSA-2026:75583)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:75583 advisory. The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating system...

RHEL 10 : freerdp (RHSA-2026:75570)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:75570 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...