netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary

Summary io.netty.incubator:netty-incubator-codec-bhttp can enter a non-terminating parse loop when a known-length Binary HTTP field section ends exactly after a complete field line. A remote peer that can send Binary HTTP input to a Netty pipeline using BinaryHttpParser / BinaryHttpDecoder can us...

Malicious code in arone (crates.io)

arone is a malicious crate published to crates.io as part of the coordinated build-time payload campaign on 2026-08-20 that trojanized arrayref, internment, and append-only-vec and published the proc-macro1 typosquat of proc-macro2. It was used as an attacker-controlled dependency carrying a...

Malicious code in proc_macro_en (crates.io)

proc-macro-en is a malicious crate published to crates.io as part of the coordinated build-time payload campaign on 2026-08-20 that trojanized arrayref, internment, and append-only-vec and published the proc-macro1 typosquat of proc-macro2. It was used as an attacker-controlled dependency carryin...

Routeglass

Routeglass - высокоскоростной инструмент для идентификации роутеров и сетевых устройств Routeglass — это быстрый многопоточный инструмент для фингерпринтинга роутеров, написанный на Go. Цель проекта проста: идентифицировать веб-доступные роутеры, межсетевые экраны, шлюзы и встроенные сетевые...

CVE-2026-53614

A flaw was found in util-linux. The mount8 SUID binary does not sanitize the LIBMOUNTFORCEMOUNT2 environment variable before use. A local unprivileged user can set this variable to force mount8 to use the legacy two-step mount2 code path, which applies security restrictions such as nosuid and...

ida-cli

ida-cli macOS 및 Linux에서 바이너리 분석을 위한 헤드리스 IDA CLI 및 스킬 우선skill-first 툴킷. ida-cli는 런타임 백엔드를 자동 선택하고, 필요 시 로컬 서버를 자동 시작하며, 플랫 CLI, stdio MCP 전송transport, Streamable HTTP MCP 전송transport으로 동일한 표면surface을 노출합니다. 中文说明 두 가지 사용자용 진입점 로컬 ida-cli 바이너리단일 실행 파일에 클라이언트 + 서비스 포함 에이전트 환경용으로 설치 가능한 ida-cli...

binfinder

binfinder Trouver les fichiers binaires non installés via le gestionnaire de paquets Prérequis Logiciels go version = 1.12 docker version = 19 Comment compiler et exécuter binfinder Compilation root@kitploit: $ make build Une fois la compilation terminée, vous pouvez exécuter bindfinder avec :...

CVE-2022-0847_dirty-pipe

CVE-2022-0847 / Dirty Pipe Un PoC bidouillé pour Dirty Pipe CVE-2022-0847 qui détourne un binaire SUID afin de générer un shell root et tente également de restaurer le binaire endommagé. Score CVSS : 7.8 ÉLEVÉ Une faille a été découverte dans la manière dont le membre "flags" de la nouvelle...

CVE-2025-0401

CVE-2025-0401 - SUID 바이너리 악용을 통한 로컬 권한 상승 요약 CVE-2025-0401은 /usr/bin/passwd 바이너리가 잘못 구성된 시스템에서 발견된 로컬 권한 상승 취약점으로, 특정 시스템 호출 시퀀스와 결합하여 의도하지 않은 루트 수준 접근을 허용합니다. 이 익스플로잇은 공격자가 SUID 잘못된 구성을 활용하여 루트 쉘 접근을 시뮬레이션하는 방법을 보여줍니다. ⚠️ 이 PoC는 교육 및 승인된 테스트 환경에서만 사용하도록 제작되었습니다. 익스플로잇 세부 사항 이 취약점은 다음과 같은 직접 시스템...

CVE-2024-44083

CVE-2024-44083 Plante IDA sur la plupart des versions voir section Compatibilité à l'ouverture du binaire malveillant. Avertissement Ce logiciel est fourni "en l'état" à des fins éducatives et de recherche uniquement. L'auteur n'est pas responsable des dommages, pertes ou problèmes juridiques...

CVE-2026-49415

During execve2 of a SUID binary, the new virtual address space is installed before the process credentials are updated. During this window, a process running as the same user can access the target process's memory via procfs or linprocfs, because the kernel's debugging permission check still saw...

CVE-2026-49415

FreeBSD kernel is affected by a TOCTOU race in execve(2): when executing a SUID binary, the new address space is installed before credentials are updated, so a same-user process can read or modify memory via procfs/linprocfs during the window. An unprivileged local user can exploit this to gain r...

EUVD-2026-62236

During execve2 of a SUID binary, the new virtual address space is installed before the process credentials are updated. During this window, a process running as the same user can access the target process's memory via procfs or linprocfs, because the kernel's debugging permission check still saw...

CVE-2026-75935

Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted Ion binary document containing a declared-length field that causes excessive heap preallocation. To remediate this issue, users shou...

EUVD-2026-61173

Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted Ion binary document containing a declared-length field that causes excessive heap preallocation. To remediate this issue, users shou...

CVE-2026-75935

Amazon ion-java before 1.12.0 has uncontrolled heap preallocation in its binary Ion stream cursor. A crafted binary Ion document with a malicious declared-length field triggers excessive memory allocation, enabling remote denial of service. CVSS 7.5 HIGH; no in-the-wild exploitation reported. Upg...

CVE-2026-75935 Memory-amplification denial of service via declared-length preallocation in Amazon ion-java

Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted Ion binary document containing a declared-length field that causes excessive heap preallocation. To remediate this issue, users shou...

GO-2026-6171 WITHDRAWN: Malformed RowDescription and DataRow messages cause panics in github.com/lib/pq

This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". github.com/lib/pq decodes attacker-controlled RowDescription and DataRow payloads without validating their structural relationship or encoded value widths required by binary decoders. A...

EUVD-2026-60974

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.1, release tar archives record mise/bin/mise with user and group ID 1001 and packaging/standalone/install.envsubst extracts and moves it without normalizing ownership, allowing a local user with those IDs to replace a...

PT-2026-77296

Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted Ion binary document containing a declared-length field that causes excessive heap preallocation. To remediate this issue, users shou...