CVE-2022-3699

CVE-2022-3699 CVE-2022-3699 的概念验证利用程序 该利用程序已在 Windows 10 22H2 build 19045.4651 和 build 19045.3803 上测试通过 该漏洞允许非特权用户访问某些功能，从而在内核实例中实现对物理内存的读写；然而，由于这些原语涉及物理内存，要将其武器化还需要一些额外的工作 获取虚拟读原语的想法借鉴自 alfarom256，而 alfarom256 又是从 ch3rn0byl 那里得到的...

CVE-2017-16995

脆弱性の説明 Ubuntuは、デスクトップアプリケーションを中心としたオープンソースのGNU/Linuxオペレーティングシステムであり、Debian GNU/Linuxをベースとしています。最近、ホワイトハッカーによって、Ubuntuの最新バージョン（Ubuntu 16.04）にローカル特権昇格の脆弱性が存在することが発覚しました。脆弱性番号はCVE-2017-16995です。この脆弱性は、eBPF...

CVE-2022-3699

CVE-2022-3699 联想诊断驱动程序的访问控制不正确，允许低权限用户发出设备IOCTL，以执行任意物理/虚拟内存读写。 感谢ch3rn0byl的帮助（我100%完全借鉴了他的两个函数）。 说明 IOCTL 0x222000: rdmsr IOCTL 0x222008/0x22200C: HalGet/SetBusData IOCTL 0x222010: Read via MmMapIoSpace IOCTL 0x222014: Write via MmMapIoSpace 此IOCTL将从输入缓冲区提供的指针的值复制到映射的物理内存中 工作原理：...

CVE-2024-2887-REPORT

SSD アドバイザリ – Google Chrome RCE 出典: ssd-disclosure.com/ssd-advisory-google-chrome-rce 概要 Google Chrome（バージョン123およびそれ以前）における、WebAssembly（WASM）のガベージコレクション型処理に影響する重大なリモートコード実行の脆弱性。このバグは型混乱を引き起こし、任意のメモリ読み取り/書き込み、最終的にはコード実行にエスカレーションされる可能性があります。 脆弱性の詳細 この脆弱性は、WASMの同型再帰的な正準型ID...

CVE-2024-5633

CVE-2024-5633 的 PoC Longse 型号 LBH30FE200W 摄像机，以及基于该设备的产品，为位于同一本地网络中的攻击者提供了对某个端口上未记录的二进制服务 CoolView 的无限制访问。了解可用命令的攻击者能够对设备内存执行读/写操作，这可能导致例如绕过 telnet 登录并获得对设备的完全访问权限。 https://vulners.com/cve/CVE-2024-5633...

cve-2018-4233

CVE-2018-4233 Exploit para CVE-2018-4233, un error en el compilador JIT de WebKit. Probado en Safari 11.0.3 en macOS 10.13.3. Para más detalles, consulte https://saelo.github.io/presentations/blackhatus18attackingclientsidejitcompilers.pdf El exploit obtiene lectura/escritura arbitraria de memori...

CVE-2026-0799

In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to tr...

Astra Linux – Vulnerability in ntfs-3g

The file handle created in fuselibopendir, and later used in fuselibreaddir, enables arbitrary memory read and write operations in NTFS-3G through 2021.8.22 when using libfuse-lite...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-43499 – Android arm64 Local Privilege Escalation A res...

CVE-2026-58317

Unsigned to Signed Conversion Error CWE-196 vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory...

EUVD-2026-44731

Pegatron Tdelo64.sys exposes a privileged device interface, \.\TdeIo, that fails to properly restrict access to sensitive IOCTL functionality. The driver's IOCTL dispatcher does not validate caller privileges or verify user-supplied kernel memory addresses before performing memory operations. By...

CVE-2026-9492

The MBStorage DRAM lighting control module within Gigabyte Control Center GCC developed by GIGABYTE Technology has an Improper Access Control vulnerability. Authenticated local attackers can send specific IOCTL commands through the driver MyPortIOx64.sys bundled with the module, thereby arbitrari...

CVE-2026-9492

The MBStorage DRAM lighting control module within Gigabyte Control Center GCC developed by GIGABYTE Technology has an Improper Access Control vulnerability. Authenticated local attackers can send specific IOCTL commands through the driver MyPortIOx64.sys bundled with the module, thereby arbitrari...

CVE-2026-57851

MSI Feature Manager contains a local privilege escalation via the KernCoreLib64.sys kernel driver. An attacker with local access can use exposed IOCTL handlers to perform arbitrary physical memory read/write and unrestricted I/O port operations without administrator privileges. This can enable ma...

CVE-2026-57851 MSI KernCoreLib64.sys Privilege Escalation via IOCTL Handlers

MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys kernel driver that allows any locally logged-on user to perform arbitrary physical memory read/write and unrestricted I/O port operations by accessing exposed IOCTL handlers without administrator...

CVE-2026-57851 MSI KernCoreLib64.sys Privilege Escalation via IOCTL Handlers

MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys kernel driver that allows any locally logged-on user to perform arbitrary physical memory read/write and unrestricted I/O port operations by accessing exposed IOCTL handlers without administrator...

CVE-2026-38571

Cleartext storage and exposure of WPA2 credentials, and missing authentication on the rr/wr memory read/write commands, in the unauthenticated UART debug console of the Tenda N300 F3 V603 allow a physically proximate attacker to obtain stored WPA2 credentials in cleartext and to read or write...

CVE-2026-38571

The CVE-2026-38571 case concerns the Tenda N300 F3 device (version V603), where the unauthenticated UART debug console stores WPA2 credentials in cleartext and does not require authentication for rr/wr memory read/write commands. This enables a physically proximate attacker to extract stored WPA2...

CVE-2026-8918

A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform arbitrary memory read/write operations or cause a system crash BSOD by bypassing the validation mechanism.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory...

CVE-2026-8918

A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform arbitrary memory read/write operations or cause a system crash BSOD by bypassing the validation mechanism.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory...