CVE-2022-3602

CVE−2022-3602 ¿Qué es esto? Este documento y repositorio es un informe técnico de CVE−2022-3602, un problema de desbordamiento de búfer en punycode dentro de OpenSSL. Es un «anti-POC» el problema no parece explotable pensado para quienes mantienen sus propias compilaciones de OpenSSL y para los...

cve-2016-6187-poc

PoC para https://duasynt.com/blog/cve-2016-6187-heap-off-by-one-exploit...

libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption

A flaw was found in Libevent, an event notification library. An off-by-one stack buffer overflow exists in the dnsnametolabels function when processing a name-bearing DNS record. A remote attacker could send a specially crafted DNS server response, which may lead to a crash or corruption of the...

OBO

Off-By-One Diapositivas de las conferencias Off-By-One Ver todas las charlas Año ↓| Diapositivas| Lista de reproducción de YouTube ---|---|--- 2024| Diapositivas del Día 1...

libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption

A flaw was found in Libevent, an event notification library. An off-by-one stack buffer overflow exists in the dnsnametolabels function when processing a name-bearing DNS record. A remote attacker could send a specially crafted DNS server response, which may lead to a crash or corruption of the...

CVE-2023-40296

CVE-2023-40296 async-sockets-cpp hasta la versión 0.3.1 contiene una vulnerabilidad de desbordamiento de búfer por uno off-by-one en static void ReceiveFromUDPSocket udpSocket en udpsocket.hpp, alrededor de las líneas 160-167. El desbordamiento de búfer afecta a todos los servidores UDP...

CVE-2026-89783

In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix out-of-bounds write in xfrm6inputaddr when secpath is full The depth check in xfrm6inputaddr is off by one: if 1 + sp-len == XFRMMAXDEPTH goto drop; ... sp-xvecsp-len++ = x; xfrminput can leave sp-len == XFRMMAXDEPTH,...

Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-3156

Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-3156 Versión vulnerable al exploit La vulnerabilidad Baron Samedit CVE-2021-3156 afecta a las versiones heredadas de sudo 1.8.2 hasta 1.8.31p2 y a las versiones estables 1.9.0 hasta 1.9.5p1. Esta falla de desbordamiento de búfer basado en montón se...

EUVD-2026-80304

In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix out-of-bounds write in xfrm6inputaddr when secpath is full The depth check in xfrm6inputaddr is off by one: if 1 + sp-len == XFRMMAXDEPTH goto drop; ... sp-xvecsp-len++ = x; xfrminput can leave sp-len == XFRMMAXDEPTH,...

CVE-2026-89783

CVE-2026-89783 is an out-of-bounds write in the Linux kernel's xfrm6_input_addr() function (net/ipv6/xfrm6_input.c). An off-by-one in the depth check (1 + sp->len == XFRM_MAX_DEPTH instead of >=) allows a write to index 6 of a 6-element xvec[] array when the security path is already at maxi...

CVE-2006-3747

Archivos sobre mi publicación en bugtraq y el primer exploit funcional para CVE-2006-3747 desbordamiento off-by-one en modrewrite LDAP de Apache. http://www.securityfocus.com/archive/1/443870 Fecha de publicación del POC/Exploit: 2006-08-20 Autor: Jacobo Avariento Gimeno ID de CVE: CVE-2006-3747 ...

CVE-2021-3156

CVE-2021-3156 - Desbordamiento de búfer basado en montón en Sudo ⚠️ Solo para fines educativos y de investigación de seguridad autorizados Autores originales del exploit Muy agradecidos al autor original del PoC Qualys Research Team Descripción Sudo anterior a 1.9.5p2 contiene un error de desfase...

OESA-2026-3705 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: fix off-by-one in dlmmatchregions region comparison The local-vs-remote region comparison loop uses '=' instead of '', causing it to read one entry pa...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: scsi: sd: A “off-by-one” error has been fixed in sdreadBlockcharacteristics. If the device returns page 0xb1 with a length of 8 this occurs with QEMU v2.x, for example, sdReadBlockCharacteristics may attempt an out-of-bounds...

CVE-2026-90781

A flaw was found in alsa-lib. This vulnerability is an off-by-one stack buffer overflow in the sndctlasciielemidparse function. A local attacker can exploit this by supplying a specially crafted, long control-element identifier string through saved state files or command-line arguments. This can...

cve-2010-1938

🚀 Exploit FTP Off-by-One CVE-2010-1938 Un script sencillo en Python para probar una vulnerabilidad off-by-one en la librería OPIE CVE-2010-1938. Esta vulnerabilidad afecta a ciertos servidores FTP y puede permitir una Denegación de Servicio DoS o ejecución arbitraria de código. 📜 Descripción Este...

httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions

A flaw was found in the modproxyajp module of httpd. When processing AJP Apache JServ Protocol messages, the AJP getter functions attempt to read data beyond the allocated buffer size, allowing an attacker or a malformed request to cause an out-of-bounds read. This issue leads to a denial of...

CVE-2026-89726

In the Linux kernel, the following vulnerability has been resolved: lib/ucs2string.c: fix out-of-bounds read in ucs2strnlen Patch series "lib/ucs2string.c: fix out-of-bounds read in ucs2strnlen", v2. This series fixes an off-by-one out-of-bounds read in ucs2strnlen. The first patch is the real fi...

CVE-2026-89596

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i registersize/sizeofu32; i++ which runs one iteration too many. savedconfigspace is...

CVE-2026-90781

alsa-lib through 1.2.16.1 contains an off-by-one stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function (in ctlparse.c). When parsing a name= field with 64 or more characters, the function writes one byte past a 64-byte stack buffer, overwriting adjacent stack memory and potentiall...