CVE-2020-11097-POC

Crash di FreeRDP usando il POC CVE-2020-11097 avvia il server con python3 test.py connettiti al server con il seguente comando xfreerdp /v:127.0.0.1:3389 /u:user /p:pass /gt:127.0.0.1 /log-level:DEBUG...

CVE-2021-41160

CVE-2021-41160 FreeRDP ist eine freie Implementierung des Remote Desktop Protocol RDP, veröffentlicht unter der Apache-Lizenz. In betroffenen Versionen kann ein bösartiger Server Out-of-Bound-Schreibzugriffe bei einem verbundenen Client auslösen. Verbindungen, die GDI oder SurfaceCommands zum...

CVE-2024-52510

Nextcloud X-E2EE-SIGNATURE Bypass POC Resumo Durante a operação normal do protocolo E2EEv2 do Nextcloud, os clientes assinam criptograficamente os metadados da pasta antes de enviá-los ao servidor. Isso garante que os metadados não tenham sido adulterados quando são recuperados novamente para fin...

jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication

A flaw was found in pgjdbc, an open-source PostgreSQL JDBC Driver. A malicious server can exploit this vulnerability by instructing the driver to perform SCRAM-SHA-256 Salted Challenge Response Authentication Mechanism Secure Hash Algorithm 256 authentication with an excessively large iteration...

postgres-protocol: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service

A malicious, compromised, or man-in-the-middle server can supply an arbitrarily large SCRAM-SHA-256 PBKDF2 iteration count during authentication. The client runs it inline with no upper bound, pinning a tokio worker thread for minutes per connection, possibly stalling the whole async runtime...

libssh2-Exploit

libssh2-Exploit Erstellen eines Exploits für die in CVE-2019-13115 beschriebene libssh2-Sicherheitslücke Ziele 1. Ein OpenSSH-Server einrichten. // Bis 20. Oktober abgeschlossen 2. Einen libssh2-cpp-Client erstellen und eine Verbindung zum Server herstellen. // Bis 20. Oktober abgeschlossen 3. De...

sh4d0wup

sh4d0wup root@kitploit: % docker run -it --rm ghcr.io/kpcyrd/sh4d0wup:edge -h Usage: sh4d0wup OPTIONS Commands: bait Start a malicious update server front Bind a http/https server but forward everything unmodified infect High level tampering, inject additional commands into a package tamper Low...

CVE-2026-62960 Git for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windows

Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transportgetremotebundleuri, fetchbundleuriinternal, and copyuritofile in bundle-uri.c during clone or fetch when transfer.bundleuri=true. Non-HTTPS values...

CVE-2026-62960 Git for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windows

Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transportgetremotebundleuri, fetchbundleuriinternal, and copyuritofile in bundle-uri.c during clone or fetch when transfer.bundleuri=true. Non-HTTPS values...

CVE-2026-62960

Git for Windows prior to 2.55.0.windows.4 is vulnerable to a security bypass in bundle-uri.c . When transfer.bundleuri=true, a malicious remote Git server can advertise a bundle URI processed by transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file(). Non-HTTP(S) va...

GO-2026-6172 WITHDRAWN: Backend frame lengths cause pre-validation memory exhaustion in github.com/lib/pq

This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". github.com/lib/pq allocates the backend-declared PostgreSQL frame payload before applying a protocol length bound or a phase-specific message-type check. A malicious server or active networ...

libssh: libssh: denial of service via SFTP responses with unknown request IDs

A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service...

DEBIAN-CVE-2026-63409

Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.296, a malicious Deskflow server can send an odd-length DSOP vector to ServerProxy::setOptions in src/lib/client/ServerProxy.cpp, causing the missing value after the final option key to be read beyond the vect...

EUVD-2026-60463

Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.296, a malicious Deskflow server can send an odd-length DSOP vector to ServerProxy::setOptions in src/lib/client/ServerProxy.cpp, causing the missing value after the final option key to be read beyond the vect...

Important: wget

Issue Overview: GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the cleanmetalinkstring function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document containing a whitespace-only URL...

CVE-2026-72310 smb: client: fix overflow in passthrough ioctl bounds check

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix overflow in passthrough ioctl bounds check smb2ioctlqueryinfo validates the PASSTHRUFSCTL response payload before copying it to userspace. The payload offset and length both come from 32-bit fields. The bounds...

CVE-2026-72903 Tabby: Windows SFTP path traversal allows a malicious server to write files outside the selected download directory

Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can return a backslash traversal filename through entry.name. In tabby-ssh/src/session/sftp.ts, SFTPSession.readdir and makeFile use POSIX path processing that preserves the backslashes a...

CVE-2026-72579

NASA HyperCP (main branch) contains an OS command injection vulnerability exploitable by a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gsfc.nasa.gov. The Source/OBPGSession.py handler parses server response headers without sanitization and forwards attacker-c...

CVE-2026-54876

Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim clien...

OpenSSL Security Advisory 20260805

OpenSSL Security Advisory 20260805 - A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries...