Lucene search
+L

76 matches found

Kitploit
Kitploit
added 2026/08/25 8:21 p.m.1 views

POC-CVE-2018-4327-and-CVE-2018-4330

brokentooth POC لـ CVE-2018-4327 على الأقل هذا ما أعتقده، نظرًا لأن كلاً من CVE-2018-4327 وCVE-2018-4330 تمت الكتابة عنهما بواسطة @SparkZheng، لكن لا يُذكر أي منهما يتعلق بأي ثغرة، وبما أنه وصف هذا أولاً، فسأخمّن. تم اختباره على iPhone 6S 11.3.1 من المفترض أن يعمل حتى 11.4 يتيح لك تعيين قيمة PC...

9.3CVSS7.6AI score0.07213EPSS
SaveExploits4References1
Kitploit
Kitploit
added 2026/08/25 7:18 p.m.1 views

brokentooth

brokentooth POC pour CVE-2018-4327 du moins je le pense puisque CVE-2018-4327 et CVE-2018-4330 ont tous deux été discutés par @SparkZheng mais il n'est pas clair de sa part lequel correspond à quel bogue, mais comme il a décrit celui-ci en premier, je fais une supposition. Testé sur iPhone 6S...

9.3CVSS7.7AI score0.07213EPSS
SaveExploits4References1
Kitploit
Kitploit
added 2026/08/25 7:17 p.m.1 views

toothfairy

toothfairy Lié à brokentooth lien ci-dessous. Contrairement à brokentooth, toothfairy ne nécessite pas d'appuyer sur des boutons du menu Bluetooth. Les deux CVE ont été révélées par @SparkZheng mais sans POC, j'ai donc décidé d'en créer une pour l'expérience d'apprentissage. Le code n'est pas...

9.3CVSS7.6AI score0.07213EPSS
SaveExploits4References2
Kitploit
Kitploit
added 2026/08/25 12:35 p.m.1 views

toothpicker

ToothPicker ToothPicker est un fuzzer in-process guidé par couverture pour iOS. Il a été développé pour cibler spécifiquement le démon Bluetooth d'iOS bluetoothd et pour analyser divers protocoles Bluetooth sur iOS. Construit avec FRIDA, il peut être adapté pour cibler n'importe quelle plateforme...

5.5AI score
SaveExploits0References9
Kitploit
Kitploit
added 2026/08/25 4:24 a.m.1 views

bluetoothdPoC

@RaniXCH bluetoothdPoC CVE-2018-4087 PoC ما هو الموعد المتوقع؟ هل هو كسر حماية؟ يعتمد الأمر؛ هل لديك أي ثغرة في النواة؟ يمكنك ربطها مع بعضها بكل ترحيب. هذا الاستغلال يتيح لك سطح هجوم ضخمًا من داخل صندوق الرمل. https://www.weibo.com/ttarticle/p/show?id=2309404271293301154324 - @SparkZheng - iOS...

9.3CVSS7.6AI score0.07213EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/08/19 10:54 a.m.1 views

UnjailMe

UnjailMe Une évasion de sandbox basée sur : le proof-of-concept CVE-2018-4087 par Rani Idan Zimperium le proof-of-concept de débordement de securityd par @cheesecakeufo zeroday, aucun CVE connu, merci Abraham ! À propos du PoC ZIMPERIUM Rani a utilisé sbtool de Jonathan Levine pour découvrir quel...

9.3CVSS0.07213EPSS
SaveExploits4References1
NVD
NVD
added 2026/08/18 3:17 p.m.8 views

CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

6.3CVSS0.00201EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/08/18 2:33 p.m.14 views

CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

6.3CVSS5.4AI score0.00201EPSS
SaveExploits0References3
CVE
CVE
added 2026/08/18 2:33 p.m.20 views

CVE-2026-75032

BlueZ's AVRCP implementation lacks packet length validation in parse_media_element() and parse_media_folder(), causing out-of-bounds reads that crash bluetoothd (DoS) and may leak heap memory. Exploitation requires user pairing. Mitigation: disable AVRCP profile or restrict Bluetooth pairing to t...

6.3CVSS5.4AI score0.00201EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/18 2:33 p.m.7 views

EUVD-2026-60941

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

6.3CVSS5.4AI score0.00201EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/18 2:33 p.m.39 views

CVE-2026-75032 Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

6.3CVSS0.00201EPSS
SaveExploits0References2
Debian CVE
Debian CVE
added 2026/08/18 2:33 p.m.9 views

CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

6.3CVSS5.5AI score0.00201EPSS
SaveExploits0
RedhatCVE
RedhatCVE
added 2026/08/18 2:33 p.m.4 views

CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

6.3CVSS5.5AI score0.00201EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/08/18 12:00 a.m.17 views

PT-2026-77138

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse...

6.3CVSS5.4AI score0.00201EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
added 2026/08/18 12:00 a.m.4 views

Linux Distros Unpatched Vulnerability : CVE-2026-75032

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP...

6.3CVSS5.6AI score0.00201EPSS
SaveExploits0References4
EUVD
EUVD
added 2025/10/07 12:30 a.m.11 views

EUVD-2019-18310

Malware in sbrugna...

8.8CVSS6.5AI score0.0143EPSS
SaveExploits1References6
Fedora
Fedora
added 2023/12/11 1:28 a.m.47 views

[SECURITY] Fedora 38 Update: bluez-5.70-5.fc38

Utilities for use in Bluetooth applications: - avinfo - bluemoon - bluetoothctl - bluetoothd - btattach - btmon - hex2hcd - l2ping - l2test - mpris-proxy - rctest The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A...

6.3CVSS7.1AI score0.07879EPSS
SaveExploits9
Amazon
Amazon
added 2023/10/19 12:00 a.m.37 views

Medium: bluez

Issue Overview: An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVCATTRREQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server into returning more bytes than the buffer actually holds, resulting in...

8.8CVSS7.2AI score0.0143EPSS
SaveExploits2
OpenVAS
OpenVAS
added 2023/01/09 12:00 a.m.23 views

Huawei EulerOS: Security Advisory for bluez (EulerOS-SA-2023-1090)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

9.1CVSS8AI score0.01544EPSS
SaveExploits2References2
Tenable Nessus
Tenable Nessus
added 2022/11/16 12:00 a.m.40 views

SUSE SLED15: bluez / bluez-auto-enable-devices / bluez-cups / bluez-deprecated / etc (SUSE-SU-2022:3981-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3981-1 advisory. - CVE-2021-43400: Fixed use-after-free in gatt-database.c bsc1192394. - CVE-2021-3658: Fixed...

9.1CVSS6.8AI score0.01544EPSS
SaveExploits0References7
Rows per page
Query Builder