CVE-2020-16898-EXP-POC

CVE-2020-16898 CVE-2020-16898 Windows TCP/IP 원격 코드 실행 취약점 EXP&POC 재현 forforever：https://www.cnblogs.com/forforever/p/13846077.html poc CVE-2020-16898Checker-poc 명령: 관리자 권한으로 powershell/CMD 실행 Powershell.exe -ExecutionPolicy UnRestricted -File .\CVE-2020-16898-poc.ps1 exp cve-2020-16898-exp2 조건: 대...

CVE-2021-34767

CVE-2021-34767 설명 Catalyst 9800 시리즈 무선 컨트롤러용 Cisco IOS XE 소프트웨어 IPv6 서비스 거부 취약점 Cisco Catalyst 9000 제품군 무선 컨트롤러용 Cisco IOS XE Wireless Controller Software의 IPv6 트래픽 처리 과정에서 발생하는 취약점으로, 인증되지 않은 인접 공격자가 특정 VLAN에 L2 루프를 유발하여 해당 VLAN에 대한 서비스 거부DoS 조건을 발생시킬 수 있습니다. 이 취약점은 특정 링크-로컬 IPv6 트래픽 처리 시의 논리적 오...

[SECURITY] Fedora 45 Update: telepathy-salut-0.8.1-37.fc45

telepathy-salut is a Telepathy connection manager for link-local XMPP. Normally, XMPP does not support direct client-to-client interactions, since it requires authentication with a server. This package makes it is possible to establish an XMPP-like communications system on a local network using...

Critical: amazon-ssm-agent

Issue Overview: Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. CVE-2026-42505 go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2...

Critical: amazon-ssm-agent

Issue Overview: Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. CVE-2026-42505 go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2...

ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts

Summary Address6.isLinkLocal recognizes fe80::/64 rather than fe80::/10. Link-local unicast is the whole /10 under RFC 4291 §2.4 and the IANA IPv6 Special-Purpose Address Registry, so the method returns false for every link-local address outside the one /64 that stateless address autoconfiguratio...

Incorrect Behavior Order

Overview ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Incorrect Behavior Order via the isLinkLocal method, which incorrectly compared only the first 64 bits of an IPv6 address against the fixed patte...

CVE-2026-101913

A flaw was found in ip-address. The library fails to validate the complete range of IPv6 link-local addresses during address classification checks. A remote attacker can provide a specially crafted IPv6 address to bypass security controls that rely on this verification. Successful exploitation ca...

CVE-2026-101913

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can...

CVE-2026-101913 ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can...

EUVD-2026-88399

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can...

CVE-2026-101913: Incorrect Comparison

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can...

CVE-2026-16515 ICMPv6 error messages sent for multicast-destined packets and non-unique source addresses enable network amplification in Zephyr's IPv6 stack

neticmpv6senderror in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section 2.4 suppression rules do not answer an ICMPv6 error with an ICMPv6 error. It did not check whether the triggering packet's source address identifies a single node rule e.6 or whether the packet was sen...

PT-2026-95410

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description The net icmpv6 send error function in subsys/net/ip/icmpv6.c fails to implement all RFC 4443 section 2.4 suppression rules, which dictate that an ICMPv6 error should not be answered with anoth...

CVE-2026-89049

A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent SSM Agent before 3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote...

CVE-2026-89049 Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent

A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent SSM Agent before 3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote...

CVE-2026-89049

AWS Systems Manager Agent (SSM Agent) before 3.3.4851.0 on all platforms is affected by a server-side request forgery (SSRF) flaw in the Session Manager port forwarding to remote hosts functionality. The root cause is improper validation of equivalent address representations , allowing an authent...

CVE-2026-89049 Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent

A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent SSM Agent before 3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote...

CVE-2026-89049 Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent

A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent SSM Agent before 3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote...

CVE-2026-89049: Server-Side Request Forgery (SSRF)

A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent SSM Agent before 3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote...