nftables-oob-read-write-exploit-CVE-2023-35001-

nftables oob read/write exploit CVE-2023-35001 Exploit used at pwn2own Vancouver 2023 on Ubuntu desktop. The exploit supports the kernel version available at the beginning of the event 5.19.0-35. Requirements C compiler Go compiler Usage root@kitploit: Build $ make Run $ ./exploit This produces a...

CVE-2021-30632

From: https://github.com/github/securitylab/tree/main/SecurityExploits/Chrome/v8/CVE-2021-30632 El análisis de este error se puede encontrar aquí. Este es un error de Chrome reportado por un investigador anónimo y se cree que fue explotado en la naturaleza. El exploit aquí presentado se probó en ...

CVE-2024-5274

CVE-2024-5274 authors: @mistymntncop, @buptsb Shoutout to @buptsb for his major contribution of discovering both the DCHECK bytecode mismatch POC and then discovering how to elevate that primitive to more powerful OOB read/write primitives. Without him this exploit would not be possible :- based ...

Important: Red Hat Security Advisory: libXfont2 security update

An update for libXfont2 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write

A flaw was found in the libXfont2 font-server client. A remote attacker, by operating a malicious font server, could exploit an out-of-bounds read/write vulnerability. This occurs because the client incorrectly handles font data, leading to an out-of-bounds memory access. This can lead to privile...

Important: Red Hat Security Advisory: libXfont2 security update

An update for libXfont2 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

Elysium-Vanguard-Sentinel-Audit

SENTINEL-ROOT-AUDIT: Honor Magic V2 Hypervisor Detection Suite ➲ Project Overview SENTINEL-ROOT-AUDIT is a professional-grade security suite designed to audit kernel integrity and detect hypervisor-level interventions on the Honor Magic V2 SM8550. While the core vulnerability CVE-2025-38352 allow...

CVE-2022-1015

CVE-2022-1015 Un'analisi e un Proof-of-Concept di escalation locale dei privilegi per una vulnerabilità di lettura e scrittura OOB nel kernel Linux. Puoi trovare l'analisi di questa vulnerabilità sul mio blog e anche la mia introduzione a nftables qui. Una nota importante Non ci si deve aspettare...

CVE-2026-18794

The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by passing inconsistent data...

ANT-2026-PQ3CNCCK · firecracker-microvm/firecracker · Memory Safety / Out-of-Bounds Read+Write (unsafe Rust)

oob-read high CVE-2026-5747 GHSA-776c-mpj7-jm3r Severity Claude high · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-PQ3CNCCK: Virtio-PCI queue size writable after activation enables host OOB I...

Linux Distros Unpatched Vulnerability : CVE-2026-73433

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GStreamer gst-plugins-good avidemux. When parsing FUJIFILM metadata in an AVI strd chunk, gstavidemuxparsestrd decrements a remaining-length...

Exploit for Type Confusion in Google Chrome

CVE-2024-5274 authors: @mistymntncop, @buptsb Shoutout to @bup...

CVE-2024-42236

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Prevent OOB read/write in usbstringcopy Userspace provided string 's' could trivially have the length zero. Left unchecked this will firstly result in an OOB read in the form if str0 - 1 == '\n' followed...

CVE-2024-42236

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Prevent OOB read/write in usbstringcopy Userspace provided string 's' could trivially have the length zero. Left unchecked this will firstly result in an OOB read in the form if str0 - 1 == '\n' followed...

CVE-2024-42236

In CVE-2024-42236, the Linux kernel vulnerability affects usb: gadget: configfs, specifically usb_string_copy(), where an userspace string with length zero can bypass validation, causing an OOB read (str[0-1] before check) followed by an OOB write (str[0-1] = '\0'). The issue is caused by insuffi...

BIT-TENSORFLOW-2022-23574 Out of bounds read and write in Tensorflow

Tensorflow is an Open Source Machine Learning Framework. There is a typo in TensorFlow's SpecializeType which results in heap OOB read/write. Due to a typo, arg is initialized to the ith mutable argument in a loop where the loop index is j. Hence it is possible to assign to arg from outside the...

CVE-2023-21367

In Scudo, there is a possible way to exploit certain heap OOB read/write issues due to an insecure implementation/design. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

Integer overflow in TFLite

Impact An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup operations: cc int embeddingsize = 1; int lookupsize = 1; for int i = 0; i data.i32i; lookupsize = dim; outputshape-datak = dim; for int i = 1; i datak = dim; Both embeddingsize and lookupsize are...

CVE-2022-23559

Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup operations. Both embeddingsize and lookupsize are products of values provided by the user. Hence, a malicious user could trigger overflows in the...

Integer overflow

Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup operations. Both embeddingsize and lookupsize are products of values provided by the user. Hence, a malicious user could trigger overflows in the...