netwave-dosvulnerability

Netwave IP Camera 服务器存在未经身份验证的拒绝服务漏洞，可通过向任何固件发送一个巨大的POST请求触发。 CVE| 描述 ---|--- CVE-2018-6479| 未认证的远程拒绝服务漏洞 CVSS| 评分| 详情 ---|---|--- 3| 7.3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:X/RL:W/RC:X 0. 引言： 在一次物联网安全研究中，在不同IP摄像头供应商的产品中发现了一些漏洞。Netwave IP Camera...

LiveHiddenCamera

隐形摄像头直播 隐形摄像头直播（Live Hidden Camera，简称 LHC）是一个可在不显示预览界面的情况下，录制 Android 设备实时视频和音频的库。 动机 我正在研究一款基于 Android 的恶意软件，并决定创建一款多功能 RAT（远程管理工具）。当时我正在研究直播流，发现了一些基于 RTMP 的开源项目，包括： https://github.com/begeekmyfriend/yasea https://github.com/ant-media/LiveVideoBroadcaster https://github.com/TakuSemba/RtmpPublish...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

HVCIPwned

CVE-2024-35250 Escalación de privilegios local mediante desreferencia de puntero no confiable en el controlador Windows Kernel Streaming ks.sys. Exploit solo de datos: omite la integridad de código protegida por hipervisor HVCI. Resumen Campo| Detalle ---|--- CVE| CVE-2024-35250 Componente| ks.sy...

CVE-2023-36802

CVE-2023-36802 CVE-2023-36802 野外案例 说明 使用 PreviousMode 覆盖原语 https://cwresearch.tistory.com/entry/Microsoft-Streaming-Service-Proxy-Elevation-of-Privilege-Vulnerability-CVE-2023-36802 致谢 chompie Google Project 0...

RedactKit

RedactKit — 全部红化，全面保护 RedactKit 是一款 Firefox 扩展，通过自动隐藏网页上的敏感或个人词汇来帮助您保护隐私。无论是您的 姓名、邮箱还是其他信息 ，RedactKit 都会实时将这些词替换为 REDACTED，甚至在表单字段和浏览器标签页标题中也能生效。 非常适合 主播 🎮、屏幕共享者 💻，或任何厌倦手动模糊个人信息的人 🔒。 🔧 它能做什么 在任意网站上即时红化指定词汇 覆盖所有内容 — 页面文本、输入框、标签页标题等 实时响应页面变化 — 无需刷新 完全可自定义的词列表 干净简洁的弹出界面，含保存和开关按钮 100% 本地运行 — 不连接任何外部服...

CVE-2025-55182-RCE-Exploit

CVE-2025-55182 的概念验证（POC） – Next.js 16.0.6 远程代码执行 此仓库包含一个针对 CVE-2025-55182 的有效概念验证（POC），该漏洞是影响 Next.js 16.0.6 的一个严重反序列化漏洞。 该利用滥用 $@ 块反序列化和 Chunk.prototype.then，以完全控制块解析过程，并在服务器上实现 任意代码执行（RCE） 。 漏洞摘要 Next.js 使用内部的 Chunk 对象以及一个用于服务器操作的流式/反序列化机制。 通过滥用 $@ 来反序列化一个 Chunk 引用 ，并将 Chunk.prototype.then...

CVE-2021-35492

漏洞信息 漏洞标题： Wowza Streaming Engine 4.8.11+5 - 拒绝服务 CVE： CVE-2021-35492 日期： 2021-10-06 漏洞作者： N4nj0 软件链接： https://www.wowza.com/products/streaming-engine 版本： 4.8.11+5 测试环境： Wowza Streaming Engine = 4.8.11+5 漏洞公告： https://n4nj0.github.io/advisories/wowza-streaming-engine-i/ TWowza Streaming Engine（原名...

CVE-2026-71888

In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields disagreed about whether authenticated attributes were present. RFC 5652 sec. 9.1 pairs the two, requiring that authAttrs be present whenever...

Crimson-Cloak-ISH-wrapper-iOS-

Crimson-Cloak-ISH-wrapper-iOS 用于无需越狱最大化 iSH iOS 应用能力的封装器。 功能 HTTP API + 内嵌仪表板，地址为 http://127.0.0.1:8088 WebSocket 实时流，地址为 ws://127.0.0.1:8089 自动发现 SynChan 工具（Huginn、OmnINT、Daedalus、Argus、Neural、Ophelia、Hecate、MIDAS、SynChan、Crimson Cloud） 每个工具的快捷按钮 剪贴板同步、文件监视器、网络监控、保活 SSH 反向隧道自动连接到 Kali/Pi iOS...

[SECURITY] Fedora 45 Update: icecast-2.4.4-29.fc45

Icecast is a streaming media server which currently supports Ogg Vorbis and MP3 audio streams. It can be used to create an Internet radio station or a privately running jukebox and many things in between. It is very versatile in that new formats can be added relatively easily and supports open...

[SECURITY] Fedora 45 Update: gstreamer1-plugins-good-1.28.7-2.fc45

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types ...

CVE-2026-5724

Resumen El servicio frontend de Temporal no aplica autenticación en las RPC gRPC de streaming. La cadena de interceptores de streaming omite el interceptor de autorización, lo que permite que llamadores no autenticados accedan a AdminService/StreamWorkflowReplicationMessages, un endpoint...

PYSEC-2026-4176 urllib3: Chunked Deflate streaming can enter an infinite loop

Impact urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading content in chunks instead of loading the entire response body into memory at once. urllib3 can decompress response bodies according to the HTTP Content-Encoding header. When streaming a...

Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)

ImpactDenial of service via memory exhaustion. Affects all callers who streamed compressed responses relying on the chunk size — explicit iterbyteschunksize=... or the default — to bound memory. The decoder ignored that bound, so a chunk could be far larger than requested and a single compressed...

CVE-2026-Mastodon-Streaming-CRLF-Injection

CVE-2026-XXXXX: Mastodon Streaming Server — HTTP 响应头注入（CRLF 注入） 漏洞概览 项目| 详情 ---|--- CVE 编号| CVE-2026-XXXXX 影响产品| Mastodon（流媒体服务器） 影响版本| ≤ 4.5.9 漏洞文件| streaming/index.js 第 188–206 行 漏洞类型| HTTP 响应头注入 / CRLF 注入 CWE| CWE-74：输出特殊元素不当中和 CVSS 3.1| 6.5（中危） 攻击方式| 网络远程，无需认证 漏洞描述 当 WebSocket...

CVE-2024-30090

CVE-2024-30090 - LPE PoC CVE-2024-30090 encontrado por Angelboy con DEVCORE. Parent.cpp Obtén la base de ntoskrnl mediante NtQuerySystemInformation integridad media - Compila como x64. Child.cpp El exploit para CVE-2024-30090 - Compila como x86. Agradecimientos Un gran agradecimiento a Angelboy p...

AlmaLinux 9.6 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.6:CLSA-2026:1785457027)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785457027 advisory. - When using the tarfile module with a file opened in streaming mode mode=r| the tarfile module did not properly handle EOF, making archive...

Rocky Linux 8 [CIQ] Security Update: python3.11-urllib3 Multiple Vulnerabilities (crlsa-2026_1224)

The Rocky Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-20261224 advisory. urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66418 urllib3: urllib3 Streaming API improperly handles highly...

Rocky Linux 8 [CIQ] Security Update: python3.12-urllib3 Multiple Vulnerabilities (crlsa-2026_1226)

The Rocky Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-20261226 advisory. urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66418 urllib3: urllib3 Streaming API improperly handles highly...