watchTowr-vs-Netscaler-CVE-2026-8451

CVE-2026-8451 Citrix Netscaler 内存越界读取 Citrix Netscaler 越界读取检测构件生成工具！ 检测实战 此检测构件生成器将接受目标 Netscaler 设备，并尝试通过 CVE-2026-8451 泄露内存。 只需提供目标系统。包含协议，例如 https://192.168.80.125。 以下是它泄露部分内存的示例： root@kitploit: $ python3 watchTowr-vs-Netscaler-CVE-2026-8451.py https://192.168.80.125 / | | |\ \ \ / / \ \ / |...

netscaler-saml-memory-disclosure-security-assessment

CVE-2026-8451 - Citrix NetScaler SAML 内存越界读取 CitrixBleed 顾问式网络安全报告 关于 NetScaler SAML 内存泄露风险的专业漏洞评估报告，包括技术影响、修复和缓解策略。 📍 报告概览 字段| 详情 ---|--- 报告类型| 漏洞评估报告 参与背景| 安全研究 主要关注点| 网络边缘安全 目标读者| 安全团队、工程团队、招聘经理 输出风格| 执行摘要、技术分析、业务影响、修复路线图 发布状态| 已脱敏，供公开作品集审查 !IMPORTANT 本报告特意进行了脱敏处理，以便在 GitHub...

cve-2025-5777-citrixbleed2_reproduction

CVE-2025-5777 — CitrixBleed 2 Citrix NetScaler 内存泄露 CVSS 9.3 — 严重 — 已在野外被积极利用 CitrixBleed 2 是 Citrix NetScaler ADC 和 NetScaler Gateway 中的一个内存泄露漏洞。身份验证端点中的输入验证不足导致内存过度读取 CWE-125 ，允许未经身份验证的攻击者泄露敏感内存内容 — 包括会话Cookie、加密材料和其他机密。 概述 字段| 值 ---|--- CVE| CVE-2025-5777 CVSS| 9.3 严重 CWE| 125 — 越界读取 受影响版本|...

CVE-2026-3055---Citrix-NetScaler-Memory-Overread-PoC

🔓 CVE-2026-3055 - Citrix NetScaler 内存越界读取漏洞利用 ⚠️ 警告 此工具仅用于教育和授权测试目的。未经明确许可，请勿在系统上使用。 📋 描述 针对 CVE-2026-3055 的漏洞利用 - 当 NetScaler ADC 和 NetScaler Gateway 配置为 SAML IDP 时存在的内存越界读取（memory overread）漏洞。 🔍 CVSS 评分：9.3 严重 向量 : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H CWE : CWE-125（越界读取） CISA KEV :...

CVE-2026-3055

CVE-2026-3055 - 安全漏洞 严重性： 不适用 CVSS： 不适用 影响： 不适用 发布时间： 2026-03-23 法律声明 仅限授权安全测试使用。 根本原因（简述） 当 NetScaler ADC 和 NetScaler Gateway 配置为 SAML IDP 时，输入验证不足，导致内存过度读取 利用条件 可访问的易受攻击目标 可预测的用户/工作流上下文 无阻止恶意请求的额外加固措施 使用方法 root@kitploit: python3 exploit.py https://target.tld 检测 监控可疑的身份验证流程偏差 调查与 CVE-2026-3055...

CVE-2026-3055-Scanner---Herramienta-de-Detecci-n

🔍 CVE-2026-3055 扫描器 - NetScaler 内存越界读取检测工具 ⚠️ 警告 此工具仅用于教育和授权测试目的。未经所有者明确许可，请勿在系统上使用。 📋 描述 用于 CVE-2026-3055 的检测工具，可识别存在内存越界读取漏洞的 Citrix NetScaler ADC 和 Gateway 设备。支持单目标、网段或主机列表扫描，检测 /wsfed/passive?wctx 端点上的内存泄漏，提取管理 session ID，验证受影响版本，并生成多种格式的报告。 🎯 功能特性 ✅ 单 URL/IP 检测 ✅ 完整网段扫描（CIDR） ✅ 从文件读取主机列表进行扫描 ...

SUSE-SU-2026:2641-1 Security update for apache2

This update for apache2 fixes the following issues Update to 2.4.66 jscPED-16334: Security issues: - CVE-2026-23918: http2: double free and possible RCE on early reset bsc1263957. - CVE-2026-24072: modrewrite elevation of privileges via apexpr bsc1263935. - CVE-2026-28780: heap buffer overflow in...

CVE-2026-18794

OpenRGB is vulnerable in its network protocol due to insufficient input data validation. An attacker can pass inconsistent data over the network to cause memory exhaustion and out-of-bounds memory reads and writes , leading to denial-of-service and potential memory corruption. The vulnerability i...

CVE-2026-18794 OpenRGB: insufficient input data checks lead to Denial-of-Service, memory overread and overwrite

The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by passing inconsistent data...

CVE-2026-18794 OpenRGB: insufficient input data checks lead to Denial-of-Service, memory overread and overwrite

The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by passing inconsistent data...

Astra Linux – Vulnerability in Linux, Linux 5.10

A flaw was discovered in the Linux kernel’s driver for ASIX AX88179178A-based USB 2.0/3.0 Gigabit Ethernet devices. The vulnerability involves multiple out-of-bounds reads and possible out-of-bounds writes...

CVE-2026-68366 usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: clamp SENDRESPONSE length to the response buffer uvcsendresponse builds the UVC control response from a user-supplied struct uvcrequestdata: req-length = mintunsigned int, uvc-eventlength, data-length;...

ROS-20260810-73-0032

The vulnerability in libssh2 is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

Vulnerability of the functions update_process_glyph_fragments() and glyph_cache_fragment_put() in the libfreerdp/cache/glyph.c file of the RDP client FreeRDP, allowing a intruder to cause a service failure

The vulnerabilities of the updateprocessglyphfragments and glyphcachefragmentput functions in the libfreerdp/cache/glyph.c file of the RDP client FreeRDP involve reading beyond the permitted range of memory. Exploiting these vulnerabilities could allow a malicious actor to cause service failures...

The vulnerability of Google Chrome’s GPU component, which allows a hacker to trigger a service failure

The vulnerability of Google Chrome’s GPU component is related to reading beyond the buffer in memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

kernel: net: sched: act_csum: validate nested VLAN headers

A flaw was found in the Linux kernel's network scheduler component. A remote attacker could send specially crafted network packets containing nested Virtual Local Area Network VLAN headers. This could cause the kernel to read beyond allocated memory, leading to a system crash and a denial of...

CVE-2026-64339

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: bound bulk IN response length to the received transfer usbiobulkmsg copies bpktlen = le16tocpubpkt-len bytes out of the bulk IN buffer usbio-rxbuf, allocated with size usbio-rxbuflen into the caller's buffer...

CVE-2026-64527

The CVE-2026-64527 entry describes a Linux kernel issue in drm/hyperv where VMBus packet size is not validated in the receive callback. hyperv_receive_sub() dispatches on msg->vid_hdr.type without knowing the host-written length, leading to a potential read of stale data when copying from hv-&...

CVE-2026-64339 usb: misc: usbio: bound bulk IN response length to the received transfer

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: bound bulk IN response length to the received transfer usbiobulkmsg copies bpktlen = le16tocpubpkt-len bytes out of the bulk IN buffer usbio-rxbuf, allocated with size usbio-rxbuflen into the caller's buffer...

kernel: net: sched: act_csum: validate nested VLAN headers

A flaw was found in the Linux kernel's network scheduler component. A remote attacker could send specially crafted network packets containing nested Virtual Local Area Network VLAN headers. This could cause the kernel to read beyond allocated memory, leading to a system crash and a denial of...