CVE-2006-3747

Files about my bugtraq publication and first working exploit for CVE-2006-3747 Apache modrewrite LDAP off-by-one buffer overflow. http://www.securityfocus.com/archive/1/443870 Public release date of POC/Exploit: 2006-08-20 Author: Jacobo Avariento Gimeno CVE id: CVE-2006-3747 Bugtraq id: 19204 CE...

CVE-2026-83742 wstrncat() unsigned integer underflow leads to an off-by-one null write in wolfSSH on non-Windows platforms

Unsigned integer underflow in wstrncat in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by sending a crafted SFTP path. wolfSSHRealPath in src/ssh.c...

CVE-2026-83742

The wolfSSL wolfSSH library (versions v1.4.11 through v1.5.0 ) is vulnerable on non-Windows platforms due to an unsigned integer underflow in the wstrncat() function within src/port.c. An authenticated remote attacker can trigger this by sending a crafted SFTP path to wolfSSH_RealPath() in src/ss...

Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-3156

Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-3156 Version Vulnarable To The Exploit The Baron Samedit vulnerability CVE-2021-3156 affects sudo legacy versions 1.8.2 through 1.8.31p2 and stable versions 1.9.0 through 1.9.5p1. This heap-based buffer overflow flaw was introduced in July 2011 via comm...

CVE-2022-3602

CVE−2022-3602 ¿Qué es esto? Este documento y repositorio es un informe técnico de CVE−2022-3602, un problema de desbordamiento de búfer en punycode dentro de OpenSSL. Es un «anti-POC» el problema no parece explotable pensado para quienes mantienen sus propias compilaciones de OpenSSL y para los...

OBO

Off-By-One Diapositivas de las conferencias Off-By-One Ver todas las charlas Año ↓| Diapositivas| Lista de reproducción de YouTube ---|---|--- 2024| Diapositivas del Día 1| Día 1 - OffByOne 2024 Presentaciones en línea 2024| Diapositivas del Día 2| Día 2 - OffByOne 2024 Presentaciones en línea...

CVE-2026-98291

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix off-by-one bounds check in RX submit btintelpciesubmitrx used frbdindex rxq-count to guard the FRBD array access, allowing frbdindex == rxq-count to pass through and index one element past the end of t...

CVE-2026-98291

The Linux kernel contains a vulnerability in the btintel_pcie component related to the btintel_pcie_submit_rx() function. An off-by-one bounds check error occurs because the function used frbd_index > rxq->count to guard the FRBD array access, incorrectly allowing an index equal to the coun...

EUVD-2026-93219

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix off-by-one bounds check in RX submit btintelpciesubmitrx used frbdindex rxq-count to guard the FRBD array access, allowing frbdindex == rxq-count to pass through and index one element past the end of t...

PT-2026-106620

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel pcie: fix off-by-one bounds check in RX submit btintel pcie submit rx used frbd index rxq-count to guard the FRBD array access, allowing frbd index == rxq-count to pass through and index one element past the en...

cve-2010-1938

🚀 Exploit FTP Off-by-One CVE-2010-1938 Un script sencillo en Python para probar una vulnerabilidad off-by-one en la librería OPIE CVE-2010-1938. Esta vulnerabilidad afecta a ciertos servidores FTP y puede permitir una Denegación de Servicio DoS o ejecución arbitraria de código. 📜 Descripción Este...

CVE-2021-3156

CVE-2021-3156 - Desbordamiento de búfer basado en montón en Sudo ⚠️ Solo para fines educativos y de investigación de seguridad autorizados Autores originales del exploit Muy agradecidos al autor original del PoC Qualys Research Team Descripción Sudo anterior a 1.9.5p2 contiene un error de desfase...

cve-2021-3156

CVE-2021-3156 -- Baron Samedit 漏洞环境 使用Dockerfille创建镜像 docker build -t cve-2021-3156:ubuntu2004 . 使用镜像创建容器 docker run --rm -it cve-2021-3156:ubuntu2004 /bin/bash 漏洞成因 在 Sudo 1.9.5p2 之前版本 中，存在一个 off-by-one 错误，可能导致 基于堆的缓冲区溢出 。 攻击者可以通过执行： sudoedit -s 在无需密码的情况下将权限提升至 root。...

CVE-2021-3156

CVE-2021-3156 Sudo anterior a 1.9.5p2 contiene un error de desfase de uno que puede resultar en un desbordamiento de búfer en el heap, lo que permite la escalada de privilegios a root mediante sudoedit -s y un argumento de línea de comandos que termina con un solo carácter de barra invertida...

tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing

A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve's N flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls...

tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing

A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve's N flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls...

CVE-2023-40296

CVE-2023-40296 async-sockets-cpp hasta la versión 0.3.1 contiene una vulnerabilidad de desbordamiento de búfer por uno off-by-one en static void ReceiveFromUDPSocket udpSocket en udpsocket.hpp, alrededor de las líneas 160-167. El desbordamiento de búfer afecta a todos los servidores UDP...

cve-2016-6187-poc

PoC para https://duasynt.com/blog/cve-2016-6187-heap-off-by-one-exploit...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Rocky Linux 9 [CIQ] Security Update: libvirt / libvirt-client / libvirt-client-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_2560)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20242560 advisory. The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition,...