CVE-2022-1015

CVE-2022-1015 شرح وإثبات مفهوم لرفع الصلاحيات المحلية لثغرة قراءة وكتابة خارج النطاق OOB في نواة لينكس. يمكنك العثور على الشرح لهذه الثغرة في مدونتي كما يمكنك العثور على مقدمتي لـ nftables هنا. ملاحظة مهمة لا يُتوقع أن يعمل الاستغلال المقدم في هذا المستودع بنجاح على إصدارات النواة المعرضة للخارج...

nftables-oob-read-write-exploit-CVE-2023-35001-

Exploit de lecture/écriture hors limites nftables CVE-2023-35001 Exploit utilisé lors du pwn2own Vancouver 2023 sur Ubuntu desktop. L'exploit prend en charge la version du noyau disponible au début de l'événement 5.19.0-35. Prérequis Compilateur C Compilateur Go Utilisation root@kitploit: Build $...

CVE-2021-30632

من: https://github.com/github/securitylab/tree/main/SecurityExploits/Chrome/v8/CVE-2021-30632 يمكن العثور على تحليل هذه الثغرة هنا. هذه ثغرة في كروم تم الإبلاغ عنها من قبل باحث مجهول ويعتقد أنه تم استغلالها في البرية. تم اختبار الاستغلال هنا على إصدار v8 9.3.345.16 الالتزام 632e6e7، وهو الإصدار...

CVE-2024-5274

CVE-2024-5274 लेखक: @mistymntncop, @buptsb @buptsb को उनके प्रमुख योगदान के लिए विशेष धन्यवाद, जिसमें उन्होंने DCHECK बाइटकोड बेमेल POC की खोज की और फिर यह पता लगाया कि उस प्रिमिटिव को अधिक शक्तिशाली OOB रीड/राइट प्रिमिटिव में कैसे बढ़ाया जाए। उनके बिना यह एक्सप्लॉइट संभव नहीं होता :- @clem1,...

Elysium-Vanguard-Sentinel-Audit

سينتينل-روت-أوديت: مجموعة كشف الهايبرفايزر لهونور ماجيك V2 ➲ نظرة عامة على المشروع SENTINEL-ROOT-AUDIT هي حزمة أمان احترافية مصممة لتدقيق سلامة النواة واكتشاف التدخلات على مستوى الهايبرفايزر في هونور ماجيك V2 SM8550. بينما تسمح الثغرة الأساسية CVE-2025-38352 بإجراءات قراءة/كتابة خارج الحدود في...

Linux Distros Unpatched Vulnerability : CVE-2026-73433

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GStreamer gst-plugins-good avidemux. When parsing FUJIFILM metadata in an AVI strd chunk, gstavidemuxparsestrd decrements a remaining-length...

Exploit for Type Confusion in Google Chrome

CVE-2024-5274 authors: @mistymntncop, @buptsb Shoutout to @bup...

CVE-2024-42236

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Prevent OOB read/write in usbstringcopy Userspace provided string 's' could trivially have the length zero. Left unchecked this will firstly result in an OOB read in the form if str0 - 1 == '\n' followed...

CVE-2024-42236

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Prevent OOB read/write in usbstringcopy Userspace provided string 's' could trivially have the length zero. Left unchecked this will firstly result in an OOB read in the form if str0 - 1 == '\n' followed...

CVE-2024-42236

In CVE-2024-42236, the Linux kernel vulnerability affects usb: gadget: configfs, specifically usb_string_copy(), where an userspace string with length zero can bypass validation, causing an OOB read (str[0-1] before check) followed by an OOB write (str[0-1] = '\0'). The issue is caused by insuffi...

BIT-TENSORFLOW-2022-23574 Out of bounds read and write in Tensorflow

Tensorflow is an Open Source Machine Learning Framework. There is a typo in TensorFlow's SpecializeType which results in heap OOB read/write. Due to a typo, arg is initialized to the ith mutable argument in a loop where the loop index is j. Hence it is possible to assign to arg from outside the...

CVE-2023-21367

In Scudo, there is a possible way to exploit certain heap OOB read/write issues due to an insecure implementation/design. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

Integer overflow in TFLite

Impact An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup operations: cc int embeddingsize = 1; int lookupsize = 1; for int i = 0; i data.i32i; lookupsize = dim; outputshape-datak = dim; for int i = 1; i datak = dim; Both embeddingsize and lookupsize are...

CVE-2022-23559

Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup operations. Both embeddingsize and lookupsize are products of values provided by the user. Hence, a malicious user could trigger overflows in the...

Integer overflow

Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup operations. Both embeddingsize and lookupsize are products of values provided by the user. Hence, a malicious user could trigger overflows in the...

PYSEC-2022-83

Tensorflow is an Open Source Machine Learning Framework. There is a typo in TensorFlow's SpecializeType which results in heap OOB read/write. Due to a typo, arg is initialized to the ith mutable argument in a loop where the loop index is j. Hence it is possible to assign to arg from outside the...

CVE-2022-23559 Integer overflow in TFLite

Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup operations. Both embeddingsize and lookupsize are products of values provided by the user. Hence, a malicious user could trigger overflows in the...

SUSE: Security Advisory (SUSE-SU-2013:1175-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2021:14706-1 Security update for kvm

This update for kvm fixes the following issues: - Fix OOB read and write due to integer overflow in sm5012doperation in hw/display/sm501.c CVE-2020-12829, bsc1172385 - Fix OOB access possibility in MegaRAID SAS 8708EM2 emulation CVE-2020-13362 bsc1172383 - Fix use-after-free in usb xhci packet...

ReadyTalk Avian JVM FileOutputStream.write() Integer Overflow

Vulnerability title: Avian JVM FileOutputStream.write Integer Overflow Author: Pietro Oliva Vendor: ReadyTalk Product: Avian JVM Affected version: 1.2.0 before 27th October 2020 Fixed Version: 1.2.0 since 27th October 2020 Description: The issue is located in the FileOutputStream.write method...