CVE-2006-3747

Files about my bugtraq publication and first working exploit for CVE-2006-3747 Apache modrewrite LDAP off-by-one buffer overflow. http://www.securityfocus.com/archive/1/443870 Public release date of POC/Exploit: 2006-08-20 Author: Jacobo Avariento Gimeno CVE id: CVE-2006-3747 Bugtraq id: 19204 CE...

CVE-2026-90118

A flaw was found in the Linux kernel's NTFS filesystem driver. An off-by-one error in the ntfsdecompress function, when processing a specially crafted compressed data attribute, can lead to out-of-bounds writes. This could result in memory corruption, potentially allowing a local attacker to...

CVE-2026-90068

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA System on Chip ASoC Dynamic Audio Power Management DAPM component. An off-by-one error in the sndsocdapmputenumdouble function allows an out-of-bounds read when handling the second enum channel. This can lead to reading...

OBO

OB1 Off-By-One Slides from OB1 Conferences Watch all the talks Year ↓| Slides| Youtube playlist ---|---|--- 2024| Slides for Day 1| Day 1 - OB1 2024 Online Presentations 2024| Slides for Day 2| Day 2 - OB1 2024 Online Presentations 2025| Slides for Day 1| Day 1 - OB1 2025 Online Presentations 202...

CVE-2022-3602

CVE−2022-3602 What is this? This document and repository is a write-up of CVE−2022-3602, a punycode buffer overflow issue in OpenSSL. It's an "anti-POC" the issue does not appear to exploitable intended for folks who maintain their own OpenSSL builds and for compiler maintainers. There is a...

Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-3156

Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-3156 Version Vulnarable To The Exploit The Baron Samedit vulnerability CVE-2021-3156 affects sudo legacy versions 1.8.2 through 1.8.31p2 and stable versions 1.9.0 through 1.9.5p1. This heap-based buffer overflow flaw was introduced in July 2011 via comm...

CVE-2026-104774

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/jsdecode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is...

CVE-2021-3156

CVE-2021-3156 - Heap-Based Buffer Overflow in Sudo ⚠️ For educational and authorized security research purposes only Original Exploit Authors Very grateful to the original PoC author Qualys Research Team Description Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based...

cve-2021-3156

CVE-2021-3156 -- Baron Samedit Vulnerability Environment Create the image using Dockerfile docker build -t cve-2021-3156:ubuntu2004 . Create a container using the image docker run --rm -it cve-2021-3156:ubuntu2004 /bin/bash Vulnerability Cause In Sudo versions prior to 1.9.5p2 , there is an...

Linux Distros Unpatched Vulnerability : CVE-2026-106431

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at ...

CVE-2021-3156

CVE-2021-3156 Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via sudoedit -s and a command-line argument that ends with a single backslash character. Credit to: Advisory by Baron Samedit of Qualys How to...

CVE-2026-106431

A flaw was found in mongo-c-driver. An off-by-one error in the BSON bulk document writer allows an attacker to cause a Denial of Service DoS or memory corruption. By supplying documents of a specific cumulative size that align with a buffer boundary, an attacker can trigger a single-byte...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.75 bug fix and security update

Red Hat OpenShift Container Platform release 4.14.75 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.72 bug fix update

Red Hat OpenShift Container Platform release 4.16.72 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

CVE-2026-106431

An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent...

EUVD-2026-95152

An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent...

CVE-2026-106431

An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent...

CVE-2026-106431 One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver

An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent...

Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass

Summary The t:jsDecode transformation in Coraza WAF contains an off-by-one error when parsing octal escape sequences. A backslash character was incorrectly included in the octal number buffer, causing strconv.ParseInt to fail for every octal escape sequence and return a null byte instead of the...

GHSA-PC5Q-QFXP-GGQV Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass

Summary The t:jsDecode transformation in Coraza WAF contains an off-by-one error when parsing octal escape sequences. A backslash character was incorrectly included in the octal number buffer, causing strconv.ParseInt to fail for every octal escape sequence and return a null byte instead of the...