qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling

A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an...

Moderate: Red Hat Security Advisory: qemu-kvm security, bug fix, and enhancement update

An update for qemu-kvm is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

CVE-2026-42945-Reverse-Shell-POC

PoC RCE avec Reverse Shell pour CVE-2026-42945 NGINX Rift Preuve de concept d'exécution de code à distance pour CVE-2026-42945 , un débordement de tas dans le module ngxhttprewritemodule de NGINX. Ce fork étend le PoC de déclenchement public avec un écouteur de reverse shell intégré et des...

windows-x86-shellcode-poc

Preuve de concept de débordement de tampon Windows x86 pour débutants Ceci est un tutoriel simple et autonome sur les exploits de débordement de tampon basé sur la pile pour Windows 32 bits. Aucun guide externe requis — tout ce dont vous avez besoin est ici. Qu'est-ce que ce dépôt ? vulnerable.c ...

pentest-writeups

pentest-writeups Kioptrix Level 1 분석 보고서 - CVE-2003-0201 Samba trans2open Kioptrix Level 1 — 침투 테스트 분석 보고서 저자: Amirbek Raxmatullayev @americo444 날짜: 2026-06-17 플랫폼: VulnHub 난이도: 초급 목표: root 권한 획득 1. 환경 설정 구성 요소| 세부 정보 ---|--- 호스트 OS| Ubuntu 26.04 하이퍼바이저| QEMU/KVM 대상| Kioptrix Level 1 VMDK 공격자 IP|...

SOC-L1-OSINT-Investigation-MikroTik-CVE-2018-1156

Investigation de Menaces SOC L1 : Services Exposés Multiples MikroTik RouterOS Analyste: Jonatan Alexander Guerrero Gomez | Rôle Cible: SOC L1 / Analyste Cybersécurité Junior Statut: Investigation Clôturée | Sévérité: Élevée Résumé Exécutif Exercice de chasse aux menaces proactive identifiant un...

CVE-2025-4517-tarfile-PATH_MAX-bypass

CVE-2025-4517 / CVE-2025-4330 — Contournement du filtre de données tarfile de Python via dépassement de PATHMAX Auteur : 0xDTC CVE : CVE-2025-4517 / CVE-2025-4330 Avis de sécurité : GHSA-6r6c-684h-9j7p Correctif CPython : PR 135037 Aperçu La fonction tarfile.extractallfilter="data" de Python est...

CVE-2021-3156-Baron-Samedit

CVE-2021-3156 – Baron Samedit Переполнение кучи в sudo | Анализ эксплуатации и смягчения Обзор CVE-2021-3156, известный как Baron Samedit , представляет собой уязвимость переполнения кучи в программе sudo. Она позволяет любому непривилегированному локальному пользователю получить привилегии root ...

thm-ice-icecast-rce-privesc

TryHackMe — Ice : Icecast 2.0.1 RCE et élévation de privilèges Windows Plateforme : TryHackMe Cible OS : Windows 7 / Windows Server 2008 R2 Difficulté : Facile Catégorie : Dépassement de tampon RCE, élévation locale de privilèges Résumé Ce rapport documente le compromis complet de la machine Ice...

CVE-2026-14266

CVE-2026-14266 — Dépassement de tampon sur le tas dans le décodeur XZ de 7-Zip Sévérité critique | CVSS : 8.8 Élevé | CWE-122 : Dépassement de tampon basé sur le tas Versions affectées : 7-Zip ≤ 26.01 | Correctif : 7-Zip 26.02 2026-06-25 Découvert et analysé par : Li Yuxuan liyuxuan504-byte et so...

nGixshell

nGixShell — это сканер CVE-уязвимостей nginx и фреймворк для эксплуатации RCE. Он включает рабочий proof-of-concept для CVE-2026-42945 — критического переполнения буфера в куче в ngxhttprewritemodule — а также сканер, охватывающий 53 CVE-уязвимости nginx , с автоматическими HTTP-пробами, снятием...

thm-cybersec-portfolio

Notes TryHackMe — Portfolio Cybersécurité Notes personnelles et résumés des salles TryHackMe complétées. Conçu comme référence d'étude et portfolio pour les postes en sécurité informatique. Salles complétées | Salle| Sujet ---|---|--- 01| Élévation de privilèges Linux| Techniques d'élévation de...

CVE-2026-78169

A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This impacts the function strcpy of the file /goform/aspRemoteApConfTempSend of the component HTTP Request Handler. Performing a manipulation of the argument Profile results in stack-based buffer overflow. The attack is...

CVE-2026-78170

A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formConfigFastDirectionW. Executing a manipulation of the argument ssid can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be...

CVE-2026-78170

UTT HiPER 1200GW (up to version 2.5.3-170306) is affected by a remote buffer overflow in the strcpy function within /goform/formConfigFastDirectionW. An authenticated attacker (low privileges) can exploit this by manipulating the ssid argument, potentially achieving full compromise of confidentia...

EUVD-2026-64692

A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formConfigFastDirectionW. Executing a manipulation of the argument ssid can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be...

CVE-2026-78170 UTT HiPER 1200GW formConfigFastDirectionW strcpy buffer overflow

A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formConfigFastDirectionW. Executing a manipulation of the argument ssid can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be...

EUVD-2026-64691

A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This impacts the function strcpy of the file /goform/aspRemoteApConfTempSend of the component HTTP Request Handler. Performing a manipulation of the argument Profile results in stack-based buffer overflow. The attack is...

libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image

A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT8BITABGR output format and a specific stride value, leading to a heap-base...

Important: Red Hat Security Advisory: libtiff security update

An update for libtiff is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabili...