kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev

A flaw was found in the Linux kernel's ipvlan component. The ipvlan devices do not properly inherit neededheadroom and neededtailroom from the physical device phydev. This can lead to insufficient space being reserved for packet headers and trailers, potentially causing memory corruption, such as...

kernel: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY

A flaw was found in the Linux kernel's Network File System Daemon nfsd component. When performing an asynchronous async copy operation, a programming error causes a stale identifier IDR entry to point to memory that has already been reused. This can lead to memory corruption, where the system...

kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF

A flaw was found in the nfsd component of the Linux kernel. This vulnerability, a use-after-free, occurs when a specific memory buffer is prematurely released while another process is still trying to access it. This timing issue can lead to memory corruption. This could result in a system crash...

kernel: svcrdma: Reject inline replies that overflow the pull-up buffer

A flaw was found in the Linux kernel's svcrdma component, which handles network communication using Remote Direct Memory Access RDMA. A remote attacker can send a specially crafted network reply that is larger than expected. This can cause the system to write data beyond the intended memory area,...

GHSA-MJCV-P78Q-W5FW github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

A denial-of-service DoS vulnerability exists in github.com/moby/sys/user before v0.4.1 when parsing specially crafted user or group database files. An attacker able to supply a malicious /etc/passwd or /etc/group-style file may cause excessive memory consumption, potentially resulting in process...

github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

A denial-of-service DoS vulnerability exists in github.com/moby/sys/user before v0.4.1 when parsing specially crafted user or group database files. An attacker able to supply a malicious /etc/passwd or /etc/group-style file may cause excessive memory consumption, potentially resulting in process...

ator

Authentication Token Obtain and Replace Extender Introduction In the world of web security testing, automation is key, and Burp Suite is the go to choice. However, to truly harness the power of Burp for automated scanning, you need the right plugins. That's where ATOR comes in. This open-source...

CVE-2024-6387

CVE-2024-6387 CVE-2024-6387 is a hypothetical example, but let's assume it is a real-world vulnerability in the OpenSSH server implementation. This vulnerability could involve a buffer overflow or memory corruption issue that allows remote attackers to execute arbitrary code on the server. Here’s...

CVE-2023-25136

CVE-2023-25136 OpenSSH 9.1 vulnerability mass scan and exploit Vulnerability Details As a reminder, OpenSSH is software that implements the SSH protocol, very frequently used to securely connect to Linux or Windows machines for remote administration. Introduced in OpenSSH 9.1, the security flaw...

aes-finder

AES Finder Utilidad para encontrar claves AES en la memoria de procesos en ejecución. Funciona para claves de 128, 192 y 256 bits. Uso Abra la solución aes-finder.sln en Visual Studio 2013 para compilar el código fuente. Alternativamente, use gcc/clang: g++ -O3 -march=native -fomit-frame-pointer...

ipa-medit

ipa-medit Ipa-medit es una herramienta de búsqueda y parcheo de memoria para ipa refirmados sin hacer jailbreak. Soporta aplicaciones iOS ejecutándose en iPhone y Mac con Apple Silicon. Fue creada para pruebas de seguridad en juegos móviles. Muchos juegos móviles tienen detección de jailbreak, pe...

ipa-medit

ipa-medit Ipa-medit is a memory search and patch tool for resigned ipa without jailbreaking. It supports iOS apps running on iPhone and Apple Silicon Mac. It was created for mobile game security testing. Many mobile games have jailbreak detection, but ipa-medit does not require jailbreaking, so...

Forblaze

Forblaze - A Python Mac Steganography Payload Generator/In-Memory Dylib/MachO Execution Author: AsaurusRex Disclaimer DO NOT use this project for purposes other than legitimate red teaming/pentesting jobs, or research. DO NOT use this for illegal activity of any kind, and know that this project i...

heffalump

Heffalump Heffalump is an endless honeypot that gives malicious bots nightmares. To use, in your robots.txt tell robots not to go to a certain URL, which heffalump is reverse proxying. Any web agent that does go to the URL will receive an endless stream of random data, which will overflow its...

CredCrack

CredCrack ⛔ OBSOLETO. Este repositorio ya no recibe mantenimiento. Considere usar CrackMapExec. Introducción CredCrack es un recolector de credenciales rápido y sigiloso. Exfiltra credenciales de forma recursiva en memoria y en texto claro. Al finalizar, CredCrack analizará y mostrará las...

EUVD-2026-95081

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when tonemappingflag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcodin...

CVE-2026-107676

FFmpeg versions through 9.0.2 are vulnerable to an uninitialized memory disclosure within the av_dynamic_hdr_plus_to_t35() function. When the tone_mapping_flag is set to 0, the function fails to initialize up to three payload bytes. An attacker can exploit this by providing crafted Matroska T.35 ...

CVE-2026-107676 FFmpeg through 9.0.2 Uninitialized Memory Disclosure via HDR10+ Metadata Serializer

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when tonemappingflag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcodin...

IRTriage

Triage de Respuesta a Incidentes: Recopilación automatizada de información del sistema valiosa para un Analista Forense. IRTriage se ejecutará automáticamente "Como ADMINISTRADOR" en todas las versiones de Windows excepto WinXP. La fuente original fue Triage-ir v0.851, un script Autoit escrito po...

meterssh

Tool Name: MeterSSH Written by: David Kennedy Company: TrustedSec Website: https://www.trustedsec.com Twitter: @TrustedSec, @HackingDave MeterSSH is a way to take shellcode, inject it into memory then tunnel whatever port you want to over SSH to mask any type of communications as a normal SSH...