kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing

A flaw was found in the Linux kernel's Soft RoCE RDMA/rxe driver. An unauthenticated remote attacker can send a specially crafted UDP packet with an unknown opcode to trigger an out-of-bounds read. This vulnerability can lead to a kernel panic, effectively causing a Denial of Service DoS on the...

kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap

A flaw was found in the Linux kernel's RDMA/rxe component. A race condition in the rxemmap function, which manages memory for Remote Direct Memory Access RDMA operations, can lead to a use-after-free vulnerability. A local attacker could exploit this timing issue to cause a system crash, resultin...

kernel: RDMA/rxe: Fix race condition in QP timer handlers

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA RXE component. A race condition exists between the retransmittimer and rxedestroyqp functions. This can cause a Queue Pair QP reference count to underflow, leading to a use-after-free vulnerability. A local attacker could...

kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

A flaw was found in the Linux kernel's RDMA/rxe component. The rxercv function does not adequately validate the BTH pad and ICRC fields of incoming packets before calculating the payload size. A remote attacker could exploit this by sending a specially crafted short packet or a packet with a forg...

kernel: ipv6: fix use-after-free in ip6_finish_output2()

A flaw was found in the Linux kernel's IPv6 networking stack. A use-after-free vulnerability exists in the ip6finishoutput2 function, where a cached pointer to the IPv6 destination address can become stale after memory reallocation. An attacker could potentially exploit this to leak sensitive...

kernel: smb: client: fix double-free in SMB2_flush() replay

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a double-free error within the SMB2flush replay mechanism, occurs when the system attempts to free a memory buffer twice. A malicious SMB server could exploit this by sending a specially crafted flush...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Security update 5.2.1 for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-prometheus-prometheus was updated to version 3.13.2: Security issues: CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling bsc1266608 CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 inpu...

CVE-2026-98173

A flaw was found in the Linux kernel's SMB client. A race condition in multichannel connection management allows network interface structures to be freed while still in use during concurrent interface refreshes. A malicious server or an attacker triggering interface updates can exploit this...

CVE-2019-19012

CVE-2019-19012 Oniguruma 6.x（6.9.4rc2 未満）の regexec.c 内の searchinrange 関数における整数オーバーフローにより、範囲外読み取りが発生します。この読み取りのオフセットは攻撃者が制御可能です（32ビットコンパイル版のみ影響）。リモート攻撃者は、細工された正規表現によって、サービス拒否や情報漏洩、あるいはその他の影響を引き起こす可能性があります。 研究者: ManhND（The Tarantula Team、VinCSS（Vingroup のメンバー）） Oniguruma とは Oniguruma は K. Kosako によ...

Vulnerabilities present in Cisco NX-OS Software

Cisco has addressed several vulnerabilities in the Cisco NX-OS Software. These vulnerabilities concern various components of the Cisco NX-OS Software. - A vulnerability in the Python interpreter allows a malicious local attacker with low privileges to escape the Python sandbox and execute arbitra...

Important: Red Hat Security Advisory: opentelemetry-collector security update

An update for opentelemetry-collector is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests

A flaw was found in gRPC-Go. Servers created with xds.NewGRPCServer can be exploited by a remote client sending a malformed RPC request that lacks the required :authority or Host headers. This can trigger an index-out-of-bounds panic, leading to the termination of the entire server process and a...

ethical-hacking-CVE-2011-2523

倫理的ハッキング | 評価課題1 実践的な脆弱性テスト - CVE-2011-2523 vsftpd 2.3.4 バックドア モジュール: - 倫理的ハッキング 大学: London Metropolitan University プログラム: BSc Hons Cyber Security and Forensic Science 法的免責事項 すべての活動は教育目的のみの制御された隔離された仮想ラボで実施されました。実際のシステムは対象としていません。すべての作業は1990年コンピュータ乱用法に準拠しています。 ラボ環境 攻撃側OS: Kali Linux ホスト 攻撃側IP:...

CVE-2019-20933

CVE-2019-20933 InfluxDB 1.7.6 之前版本在 services/httpd/handler.go 的 authenticate 函数中存在一个身份认证绕过漏洞，因为 JWT 令牌可能具有空的 SharedSecret（也就是共享密钥）。 （参见 https://nvd.nist.gov/vuln/detail/CVE-2019-20933 了解更多详情） PoC 此 PoC 利用上述 CVE 制作了一个快速而粗糙的 influxDB 客户端。 用法: usage: influx-client.py -h --host HOST --port PORT --use...

CVE-2026-85423

A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the...

CVE-2026-85489

An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and...

CVE-2026-85487

A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion...

CVE-2026-85421

A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can issue control commands, alter cluster states,...

kernel: svcrdma: Reject inline replies that overflow the pull-up buffer

A flaw was found in the Linux kernel's svcrdma component, which handles network communication using Remote Direct Memory Access RDMA. A remote attacker can send a specially crafted network reply that is larger than expected. This can cause the system to write data beyond the intended memory area,...