CVE-2020-1493

CVE-2020-1493 This vulnerability occurs in Outlook 2019 16.0.12624.20424 installed on Windows 10 1909 x64, Also This vulnerability is zero click vulnerability. TLDR; I found this bug usng winafl fuzzer. This bug occured when parsing ms-tnef file. that attachement of eml file. vulnerable method re...

CVE-2022-0995

CVE-2022-0995 Exploit for CVE-2022-0995. Uses a heap out-of-bounds write in the watchqueue component of the Linux kernel. A similar technique is described in this research https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html. The exploit has been tested on Ubuntu 21.1...

tcpdump

TCPDUMP 4.x.y by The Tcpdump Group To report a security issue please send an e-mail to [email protected]. To report bugs and other problems, contribute patches, request a feature, provide generic feedback etc please see the guidelines for contributing in the tcpdump source tree root. Anonymo...

CVE-2025-5777-CitrixBleed

CVE-2025-5777-CitrixBleed CitrixBleed-2 CVE-2025-5777 – proof-of-concept exploit for NetScaler ADC/Gateway “memory bleed” CVE-2025-5777 is a critical unauthenticated out-of-bounds read in Citrix NetScaler ADC/Gateway Gateway or AAA vServer mode. A single crafted request can dump memory containing...

CVE-2022-44311

Out-Of-Bounds Read in html2xhtml : CVE-2022-44311 Summary Html2xhtml v1.3 was discovered to contain an Out-Of-Bounds read in the function static void elmclosetreenodet nodo at procesador.c. This vulnerability allows attackers to access sensitive files or cause a Denial of Service DoS via a crafte...

Bluetooth-Crash-CVE-2017-0785

CVE-2017-0785 Bluetooth module crash This script is a modified version of https://github.com/ojasookert/CVE-2017-0785. It leaks information via SDP due to out-of-bound bytes, but sending too many packets or search requests causes the Bluetooth module on an Android smartphone above Android 4.0 to...

CVE-2021-45067

CVE-2021-45067 This bug was Out of Bounds Read caused by treating ANSI string as Unicode which can be exploited to leak sensitive information from the sandboxed adobe reader process. Blog Adobe Reader - XFA - ANSI - Unicode Confusion Information Leak Advisory CVE-2021-45067 Demo...

PwnKit

PwnKit This repository contains an exploit I developed to understand how the Polkit Pkexec vulnerability works: CVE-2021-4034 Pkexec Local Privilege Escalation. Polkit formerly known as PolicyKit is a component that controls privileges on Unix-like operating systems. It provides an organized way...

CVE-2024-29943-but-with-wasm

CVE-2024-29943, but with wasm An end-to-end exploit chain for CVE-2024-29943 that achieves arbitrary native code execution by smuggling shellcode into SpiderMonkey's WebAssembly JIT code page as f64.const immediates — no ROP, no VirtualProtect, no external toolchain. Verified working against the...

CVE-2024-21762-Safe-Check

CVE-2024-21762 - FortiOS SSL VPN Out-of-Bounds Write Overview Field| Value ---|--- CVE| CVE-2024-21762 Advisory| FG-IR-24-015 CVSS| 9.8 Critical CWE| CWE-787 Out-of-bounds Write CISA KEV| Yes - actively exploited in the wild Attack Vector| Network unauthenticated Affected Component| sslvpnd SSL V...

CVE-2023-36407

CVE-2023-36407 This is poc for CVE-2023-36407, Hyper-V Elevation of Privilege Vulnerability. https://github.com/pwndorei/CVE-2023-36407/assets/96749184/a8ef87d3-e0d0-40e5-9b23-35ab057a9c78 Vulnerability OOB Read/Write from/to Non-paged Pool via winhvr.sys!WinHvGet/SetVpState Reproduction Steps...

CVE-2020-11019

CVE-2020-11019 In FreeRDP less than or equal to 2.0.0, when running with logger set to "WLOGTRACE", a possible crash of application could occur due to a read of an invalid array index. Data could be printed as string to local terminal. This has been fixed in 2.1.0. authentication| complexity|...

CVE_2026_31694

CVE-2026-31694 Passive Scanner A passive Linux host assessment tool for CVE-2026-31694 , a FUSE readdir-cache out-of-bounds write in the Linux kernel. The scanner evaluates the running kernel, FUSE exposure, local package metadata, kernel source evidence, execution environment, and operating-syst...

d-os-descriptor

d-os-descriptor Summary The USB Gadget Subsystem includes security issues in the OS descriptor handling section of compositesetup function composite.c. Processing of properly crafted control transfer request messages result in device crash due to null pointer dereference or memory corruption...

xpc-string-leak

xpc-string-leak xpc-string-leak is a proof-of-concept exploit for an out-of-bounds memory read in libxpc. This exploit uses the vulnerability to read out-of-bounds heap memory from diagnosticd, an unsandboxed root process with the taskforpid-allow entitlement. The vulnerability: CVE-2018-4248 On...

CVE-2022-46152

CVE-2022-46152 OP-TEE OScleanupshmrefs Out-of-Bounds Read — Reproduction Environment Reference: https://optee.readthedocs.io/en/latest/building/devices/qemu.htmlqemu-v8 Security Advisory: https://github.com/OP-TEE/opteeos/security/advisories/GHSA-65w8-6mrg-52g7 Vulnerability Overview Field| Detai...

CVE-2026-21001-WebAssembly-Linear-Memory-OOB-via-Table-Index-Confusion

CVE-2026-21001 – WebAssembly Linear Memory OOB via Table Index Confusion Overview A WebAssembly module uses an imported function with no bounds check on an array index. An attacker can supply an out-of-bounds index to read or write outside the linear memory, potentially leaking host secrets or...

CVE-2026-65349

CVE-2026-65349 — getattrlist OOB Write in vfsattrpackinternal Component: XNU VFS — vfsattrpackinternal getattrlist syscall Affected: iOS / iPadOS 26.6 23G71 and earlier Fixed in: iOS / iPadOS 26.6.1 23G83 Type: Out-of-Bounds write to caller buffer Impact: Kernel heap corruption; from kernel conte...

exploits

exploits CVE-2021-22600: Linux kernel LPE exploit CVE-2021-3156: Linux local privilege escalation through heap overflow in sudo Demo CVE-2021-3156: One shot exploit for heap overflow vulnerability in sudo CVE-2020-6507: Out of bounds write in V8. Chrome versions = 83.0.4103.97. RCE CVE-2020-16040...

CVE-2025-54957

Dolby Unified Decoder CVE-2025-54957 POC When a file is processed by Dolby's DDPlus Unified Decoder, an out of bounds write is possible when the evolution data is processed. The decoder writes evolution information into a large, heap-like contiguous buffer contained by a larger struct, and the...