CVE-2026-20253

🚨 CVE-2026-20253 - 重大なSplunk Enterpriseの認証なしファイル作成脆弱性 Splunk EnterpriseおよびSplunk Cloud Platformに影響を与える、認証なしの任意のファイル作成および切り詰めの脆弱性。 📖 エグゼクティブサマリー CVE-2026-20253 は、Splunk Enterprise およびSplunk Cloud Platform における重大な脆弱性であり、露出したPostgreSQLサイドカーサービスのエンドポイントを介して、認証されていないリモート攻撃者が任意のファイルを作成または切り詰めることを可能にします...

CVE-2026-41096

CVE-2026-41096 - Crash PoC Heap overflow in DnsRawTruncateMessageForUdp dnsapi.dll. A crafted DNS response with QDCOUNT=0 and a large OPT record causes a 604-byte heap overflow when the truncation logic miscalculates the destination pointer. MSRC advisory:...

CVE-2026-41096-POC

这个 bug 位于 DnsQueryRaw 函数中（具体来说，在 DnsRawTruncateMessageForUdp 内部），所以你需要一个程序来调用它。 我也许是错的，但目前在 Windows 11 中没有任何服务或默认程序使用这个函数，这就是为什么我需要 client.c。 这个仓库有两个文件：client.c 和 poc.py： client.c：它实现了 DnsQueryRaw（你需要根据你的配置替换接口索引） poc.py：触发器使用 scapy，你必须将变量 iface 替换为你攻击机上的接口 我把这个漏洞的利用留作练习，祝好 附注：Windows 10 是安全的，那个函...

SSH-Terrapin-Prefix-Truncation-Weakness-CVE-2023-48795-Checker

terrapincheck.py Uno scanner Python leggero per CVE-2023-48795 — la vulnerabilità SSH Terrapin di troncamento del prefisso. Terrapin è una vulnerabilità a livello di protocollo in SSH che consente a un attaccante che effettua un MitM attivo di troncare le informazioni di estensione negoziate,...

CVE-2025-47812

CVE-2025-47812 Questa è una Proof of Concept PoC dell'exploit di Wing FTP Server CVE-2025-47812 Descrizione Le versioni di Wing FTP Server precedenti alla 7.4.4 presentavano una vulnerabilità di Remote Code Execution RCE dovuta al trattamento non sicuro del parametro username. Quando è consentito...

CVE-2026-82457

su-exec through version 0.3 contains a type-truncation vulnerability in its handling of numeric user and group identifiers. Values parsed via strtol are not validated before being assigned to uid_t and gid_t , so out-of-range identifiers truncate to zero—root 's ID. A local attacker with low priv...

CVE-2026-82457 su-exec through 0.3 Privilege Escalation via Numeric User ID

su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uidt and gidt, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that truncate to root's identifier, causing su-exec to execute target...

EUVD-2026-68104

su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uidt and gidt, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that truncate to root's identifier, causing su-exec to execute target...

CVE-2006-2842

Badge Licenza MIT Installazione Installa cve-2006-2842 con npm root@kitploit: npm install cve-2006-2842 -g Utilizzo Esempio per un singolo url root@kitploit: cve-2006-2842 -u http://example.com Utilizzo Esempio per un elenco di URL root@kitploit: cve-2006-2842 -l urls.txt -o out.txt Screenshot Me...

CVE-2026-20253

CVE-2026-20253 - Splunk Enterprise ⚡ Utilizzo Semplice Utilizza questo progetto solo in ambienti sicuri e autorizzati, come: Macchine virtuali locali Contenitori Docker Configurazioni di laboratorio isolate Ambienti di test di penetrazione autorizzati Setup di esempio: root@kitploit: git clone...

AZL-98193 CVE-2026-80710 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix undersized format-check buffer fmtbuffersize in dasdeckdcheckdeviceformat is declared as int, even though one of the multiplicands, sizeofstruct eckdcount, is a sizet. The expression trkcount rptmax sizeofstruct...

CVE-2026-80710

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix undersized format-check buffer fmtbuffersize in dasdeckdcheckdeviceformat is declared as int, even though one of the multiplicands, sizeofstruct eckdcount, is a sizet. The expression trkcount rptmax sizeofstruct...

CVE-2026-80672

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix u16 truncation of restart-area length check ntfscheckrestartarea validates that the $LogFile restart area and its trailing log client record array fit within the system page size: u16 raofs, ralen, caofs; ... ralen =...

EUVD-2026-67445

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix undersized format-check buffer fmtbuffersize in dasdeckdcheckdeviceformat is declared as int, even though one of the multiplicands, sizeofstruct eckdcount, is a sizet. The expression trkcount rptmax sizeofstruct...

CVE-2026-80710

CVE-2026-80710 affects the s390/dasd subsystem of the Linux kernel. In dasd_eckd_check_device_format(), the variable fmt_buffer_size is declared as a 32-bit int, but the expression trkcount * rpt_max * sizeof(struct eckd_count) is evaluated at 64-bit width. When the track range (controlled by cal...

CVE-2026-80710 s390/dasd: Fix undersized format-check buffer

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix undersized format-check buffer fmtbuffersize in dasdeckdcheckdeviceformat is declared as int, even though one of the multiplicands, sizeofstruct eckdcount, is a sizet. The expression trkcount rptmax sizeofstruct...

CVE-2026-80710 s390/dasd: Fix undersized format-check buffer

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix undersized format-check buffer fmtbuffersize in dasdeckdcheckdeviceformat is declared as int, even though one of the multiplicands, sizeofstruct eckdcount, is a sizet. The expression trkcount rptmax sizeofstruct...

EUVD-2026-67548

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix u16 truncation of restart-area length check ntfscheckrestartarea validates that the $LogFile restart area and its trailing log client record array fit within the system page size: u16 raofs, ralen, caofs; ... ralen =...

CVE-2026-80672 ntfs: fix u16 truncation of restart-area length check

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix u16 truncation of restart-area length check ntfscheckrestartarea validates that the $LogFile restart area and its trailing log client record array fit within the system page size: u16 raofs, ralen, caofs; ... ralen =...

CVE-2026-80672

CVE-2026-80672 is a u16 truncation in the Linux kernel's in-kernel NTFS driver, specifically in ntfs_check_restart_area(). The variable ra_len is declared as u16, but the computed length of the $LogFile log client record array can exceed 65535 (e.g., log_clients of 410 yields 65600), causing trun...