CVE-2021-37740

CVE-2021-37740에 대한 개념 증명 목차 소개 취약점 PoC 실행 해결 방안 조정된 취약점 공개 라이선스 변경 로그 소개 CVE-2021-37740은 MDT의 KNXnet/IP Secure 라우터 SCN-IP100.03 및 인터페이스 SCN-IP000.03의 펌웨어 v3.0.3에 영향을 미치는 서비스 거부DoS 취약점입니다. 특수하게 조작된 KNXnet/IP Secure 프레임을 보내면 장치가 추가 요청에 응답하지 않게 되어 정상 작동을 복구하려면 재부팅이 필요합니다. 이 저장소는 버그를 트리거할 수 있는 방법을 보여...

bleeding-heart

Heartbleed Heartbleed 버그 CVE-2014-0160는 OpenSSL 라이브러리의 심각한 구현 결함으로, 공격자가 피해자 서버의 메모리에서 데이터를 훔칠 수 있게 합니다. 훔친 데이터의 내용은 서버 메모리에 무엇이 있는지에 따라 달라집니다. 여기에는 개인 키, TLS 세션 키, 사용자 이름, 비밀번호, 신용카드 정보 등이 포함될 수 있습니다. 이 취약점은 SSL/TLS가 연결을 유지하는 데 사용하는 Heartbeat 프로토콜의 구현에 있습니다. 영향을 받는 OpenSSL 버전 범위는 1.0.1부터...

Rocky Linux 9 [CIQ] Security Update: libndp / libndp-debuginfo / libndp-debugsource (crlsa-2024_4636)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20244636 advisory. libndp: buffer overflow in route information length field CVE-2024-5564 Tenable has extracted the preceding description block directly from the CIQ security advisor...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: iperf3 (UTSA-2023-002138)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002138 advisory. iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field. Tenable has extracted the preceding description block...

CVE-2026-65979

A flaw was found in OpenEXR's HTJ2K decoder. A local user could be tricked into opening a specially crafted EXR image file. When processed, the decoder reads beyond the bounds of an allocated buffer due to an unvalidated header length field. This out-of-bounds read can lead to a denial of service...

CVE-2026-82435

Apache Storm workers are vulnerable to unauthenticated remote memory exhaustion due to the placement of the Netty message decoder in the pipeline. Because the decoder is installed ahead of SASL authentication handlers, it processes frames before credentials are verified. An unauthenticated peer w...

Astra Linux – Vulnerability in Wireshark

In Wireshark versions 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the WiMax DLMAP dissector could crash. This issue was addressed in the plugin plugins/epan/wimax/msgdlmap.c by validating the length field...

CVE-2026-89495

In the Linux kernel, the following vulnerability has been resolved: ocfs2: bound namelen in dlmmigraterequesthandler Patch series "ocfs2/dlm: bound peer-controlled lengths in the o2dlm". The o2dlm receive handlers trust u8 length and count fields from the wire without bounding them, so a node in ...

EUVD-2026-72341

In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control Interface FIFO. A workload granted Control Interface access can specify an excessive message length, causing an unbounded...

CVE-2026-85437

MOOS-IvP through version 24.8.1 is affected by multiple buffer overflow vulnerabilities in its IvP function string decoders (specifically in FunctionEncoder.cpp). The root cause is that decoders trust attacker-controlled length fields without validation, allowing an attacker to craft malicious en...

SUSE CVE-2026-70405

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large. snmppdus:decintegernotag/1 defaults its size limit to infinity, and...

DEBIAN-CVE-2026-70405

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large. snmppdus:decintegernotag/1 defaults its size limit to infinity, and...

EUVD-2026-69246

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large. snmppdus:decintegernotag/1 defaults its size limit to infinity, and...

CVE-2026-80594

A flaw was found in the Linux kernel's ims-pcu driver. This vulnerability allows a malicious device to trigger an infinite loop by providing a specially crafted descriptor with a zero-length field during the parsing of CDC union descriptors. This can lead to a Denial of Service DoS condition,...

kernel: net: openvswitch: reject oversized nested action attrs

A flaw was found in Open vSwitch in the Linux kernel. Improper handling of oversized nested action attributes can lead to a truncated length field, which could be exploited by a local attacker to alter kernel memory. This alteration might result in the disclosure of sensitive information or a loc...

GHSA-HMQ9-67W8-J5PW netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields

We don't enforce any limits for the encoded variable lengths that are used for fields. As the remote peer controls these it's easy for the remote peer to have us buffer data forever and so ultimately OOM...

CVE-2026-13361

IBM Informix oninit sqsgkprepare RCE via unchecked SQL Interface length field...

CVE-2026-13361

IBM Informix oninit sqsgkprepare RCE via unchecked SQL Interface length field...

EUVD-2026-57533

IBM Informix oninit sqsgkprepare RCE via unchecked SQL Interface length field...

PT-2026-71267

Name of the Vulnerable Software and Affected Versions IBM Informix affected versions not specified Description Remote code execution is possible in the sq sgkprepare function due to an unchecked length field within the SQL Interface. Recommendations At the moment, there is no information about a...