cve-2016-6187-poc

preuve de concept pour https://duasynt.com/blog/cve-2016-6187-heap-off-by-one-exploit...

CVE-2021-3156

CVE-2021-3156 Sudo قبل الإصدار 1.9.5p2 يحتوي على خطأ خارج الحدود بواحد off-by-one يمكن أن يؤدي إلى تجاوز سعة المخزن المؤقت في الكومة heap-based buffer overflow، مما يسمح بتصعيد الامتيازات إلى الجذر عبر sudoedit -s ووسيطة سطر أوامر تنتهي بحرف خط مائل عكسي backslash واحد. الشكر والفضل: إعلان من Bar...

CVE-2026-65927

An off-by-one error in the [N] flag of Apache Tomcat's RewriteValve causes rewrite processing to restart at the second rule instead of the first. This can allow an attacker to bypass access control rules that rely on the first rewrite rule being re-evaluated. The issue affects Tomcat 11.0.0-M1 th...

CVE-2026-79148

An off-by-one error in DevTools within Google Chrome prior to 152.0.7977.65 allowed a remote attacker, leveraging social engineering, to potentially read memory inside the sandbox through a crafted Chrome extension. Chromium assigns this a Low security severity. The fix is available in Chrome 152...

OBO

Off-By-One Слайды с конференций Off-By-One Посмотреть все выступления...

CVE-2006-3747

Fichiers concernant ma publication sur Bugtraq et le premier exploit fonctionnel pour CVE-2006-3747 dépassement de tampon off-by-one dans Apache modrewrite LDAP. http://www.securityfocus.com/archive/1/443870 Date de publication publique du POC/exploit : 2006-08-20 Auteur : Jacobo Avariento Gimeno...

CVE-2022-3602

CVE−2022-3602 Что это? Этот документ и репозиторий представляют собой разбор CVE−2022-3602, проблемы переполнения буфера в реализации punycode в OpenSSL. Это «анти-PoC» проблема, судя по всему, не эксплуатируема, предназначенный для тех, кто поддерживает собственные сборки OpenSSL, и для...

cve-2010-1938

🚀 Exploit FTP Off-by-One CVE-2010-1938 Un simple script Python pour tester une vulnérabilité off-by-one dans la bibliothèque OPIE CVE-2010-1938. Cette vulnérabilité affecte certains serveurs FTP et peut permettre un déni de service DoS ou une exécution de code arbitraire. 📜 Description Ce script...

CVE-2023-40296

CVE-2023-40296 async-sockets-cpp jusqu'à la version 0.3.1 contient une vulnérabilité de dépassement de tampon off-by-one dans static void ReceiveFromUDPSocket udpSocket de udpsocket.hpp, autour des lignes 160-167. Le dépassement de tampon affecte tous les serveurs UDP correspondants. Le dépasseme...

cve-2021-3156

CVE-2021-3156 -- Baron Samedit Environnement vulnérable Créer l'image avec Dockerfille root@kitploit: docker build -t cve-2021-3156:ubuntu2004 . Créer un conteneur à partir de l'image root@kitploit: docker run --rm -it cve-2021-3156:ubuntu2004 /bin/bash Cause de la vulnérabilité Dans les versions...

CVE-2021-3156

CVE-2021-3156 - Переполнение буфера в куче в Sudo ⚠️ Только для образовательных и авторизованных исследовательских целей в области безопасности Авторы оригинального эксплойта Огромная благодарность автору оригинального PoC Qualys Research Team Описание Sudo до версии 1.9.5p2 содержит ошибку...

Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-3156

بارون-ساميديت-تجاوز-سعة-المخزن-المؤقت-في-الكومة-CVE-2021-3156 الإصدارات المعرضة للثغرة تؤثر ثغرة بارون ساميديت CVE-2021-3156 على الإصدارات القديمة من sudo من 1.8.2 إلى 1.8.31p2 والإصدارات المستقرة من 1.9.0 إلى 1.9.5p1. تم إدخال هذا الخلل في تجاوز سعة المخزن المؤقت في الكومة في يوليو 2011 عبر...

CVE-2026-74598

A flaw was found in the Linux kernel's IPv6 networking stack. An off-by-one error in the validation of the Route Information option length RFC 4191 allows a remote attacker to craft a Router Advertisement RA packet. This crafted packet can cause the kernel to read up to 8 bytes beyond the intende...

SUSE CVE-2026-74598

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6routercv validates the Route Information option RFC 4191 length against the prefix length, but both checks are off by one. rinfo-length is the ND option length in units of 8...

CVE-2026-74598

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6routercv validates the Route Information option RFC 4191 length against the prefix length, but both checks are off by one. rinfo-length is the ND option length in units of 8...

CVE-2026-74598

CVE-2026-74598 is an out-of-bounds read in the Linux kernel's IPv6 stack, specifically in rt6_route_rcv() handling of the Route Information option (RFC 4191). Both length checks are off by one: the code accepts length >= 2 and length >= 1 where RFC 4191 requires stricter bounds. A remote at...

CVE-2026-74598 ipv6: fix Route Information option length validation

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6routercv validates the Route Information option RFC 4191 length against the prefix length, but both checks are off by one. rinfo-length is the ND option length in units of 8...

EUVD-2026-64535

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6routercv validates the Route Information option RFC 4191 length against the prefix length, but both checks are off by one. rinfo-length is the ND option length in units of 8...

CVE-2026-74598 ipv6: fix Route Information option length validation

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6routercv validates the Route Information option RFC 4191 length against the prefix length, but both checks are off by one. rinfo-length is the ND option length in units of 8...

CVE-2026-68767 hashcat through 7.1.2 Off-by-One Out-of-Bounds Heap Write in fgetl()

hashcat's fgetl function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZLARGE...