Malicious code in tx-broadcast-utils (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60efdf159c3ce8550c985b3f19cbe72f2bfcae0266cb63fb8c0dd458b56b9901 The gem's native-extension script ext/.../extconf.rb embeds a base64-encoded Ruby payload that is eval'd at gem install time. The payload double-fork...

frida

frida This repository contains various Frida scripts for Android application penetration testing. I created this project to demonstrate the capabilities of the Frida dynamic-analysis framework. You can read my "Introduction to Frida" blog post on Medium, where I'm explaining how to use Frida with...

Android-Passive-Location-Tracker

Android-Passive-Location-Tracker 无需明确请求任何位置权限的位置追踪应用！利用CVE-2018-15835，该漏洞利用Android操作系统通过广播意图泄露信息。...

Damn-Vulnerable-Android-Components

可恶的易受攻击的安卓组件 - DVAC 筛子重生！ 可恶的易受攻击的安卓组件（DVAC）是一款教育性安卓应用，专门暴露和演示与各种安卓组件（如 Activity、Intent、Content Provider 和 Broadcast Receiver）相关的漏洞。它被设计成一个密码管理器应用，用于安全地管理和存储密码（笑）。 受 Sieve 应用程序开创性工作的启发（该应用专注于类似漏洞，但已过时且与新版本安卓不兼容），DVAC 旨在填补空白，为学习安卓安全提供现代、最新的平台。DVAC...

asus-cmd

ASUS 路由器 infosvr UDP 广播 root 命令执行 ASUS 的多款路由器包含一个名为 infosvr 的服务，该服务监听 LAN 或 WLAN 接口上的 UDP 广播端口 9999。ASUS 的某个工具使用该服务来自动定位本地子网中的路由器，以简化路由器配置。此服务以 root 权限运行，并包含一个无需身份验证的命令执行漏洞。该服务的源代码以及路由器其余部分的代码均可从 ASUS 支持网站 获取。 CVE 分配给此问题的 CVE 编号为 CVE-2014-9583（唉，终究不是 CVE-2014-10000 :-/）。 受影响版本...

wificurse

该程序监听无线接入点在其无线站范围内发送的信标帧。一旦收到，程序提取AP的BSSID，并使用广播MAC地址发送去认证包。这导致攻击时所有连接到该AP的客户端断开连接。这本质上是一个仅用于教育目的的WiFi拒绝服务攻击工具。它仅在Linux下工作，并且需要具备在无线网络中注入数据包能力的无线网卡驱动。 使用方法：以root身份运行，并将网卡接口作为第一个参数。它会自动将接口设置为监听模式，并在1-14信道范围内监听。如果当前信道没有AP，它每1秒切换一次信道；否则，它将开始攻击，大约持续30秒。之后它会切换信道。 编译： make 安装： make PREFIX=/usr install...

CVE-2025-63353

CVE-2025-63353 PoC - FiberHome HG6145F1 可预测的默认 Wi-Fi PSK 面向 CVE-2025-63353 的教育性研究工具包和多语言 PoC，这是一个影响 FiberHome HG6145F1 RP4423 GPON ONT 设备的严重可预测默认 PSK 漏洞。 摘要 受影响的 FiberHome HG6145F1 设备上的出厂默认 Wi-Fi 预共享密钥是广播 SSID 的确定性函数。攻击者只要观察到来自易受害设备的信标帧，就能在恒定时间内推导出 WPA2 PSK，无需捕获握手包、无需字典、无需 GPU，也无需与客户端交互。 对于广播 SSI...

EUVD-2026-90316

Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHOT via a broadcast receiver. That would allow the...

USN-8849-1: Linux kernel (NVIDIA Tegra) vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...

USN-8849-1 linux-nvidia-tegra-5.15 vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...

PT-2026-103605

Name of the Vulnerable Software and Affected Versions Meta Horizon OS versions prior to 66.0.0.733.524 Description OVRMediaService can be induced to send a privileged PendingIntent containing a com.oculus.horizon CallerIdentity to any application that registers for...

CVE-2026-97925

A flaw was found in the Linux kernel's timer tick broadcast subsystem. A race condition occurs when installing a replacement clock event device concurrently with ongoing tick broadcast operations, causing the system to attempt to arm a detached timer device. If the central processing unit CPU...

CVE-2026-100854

AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and...

EUVD-2026-87834

AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and...

Improper Check for Unusual or Exceptional Conditions

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the disaggregated serving endpoint /inference/v1/generate in...

CVE-2026-52622

An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows a remote attacker to obtain sensitive information via the global API request wrapper function...

CVE-2026-97925

In the Linux kernel, the following vulnerability has been resolved: tick/broadcast: Plug clockevents replacement race 朱恺乾 reported and decoded the following race condition when a broadcast device is replaced: CPUA CPUB tickbroadcastoneshotcontrol bc = tickbroadcastdevice.evtdev;...

AZL-104648 CVE-2026-97925 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: tick/broadcast: Plug clockevents replacement race 朱恺乾 reported and decoded the following race condition when a broadcast device is replaced: CPUA CPUB tickbroadcastoneshotcontrol bc = tickbroadcastdevice.evtdev;...

UBUNTU-CVE-2026-97925

In the Linux kernel, the following vulnerability has been resolved: tick/broadcast: Plug clockevents replacement race 朱恺乾 reported and decoded the following race condition when a broadcast device is replaced: CPUA CPUB tickbroadcastoneshotcontrol bc = tickbroadcastdevice.evtdev;...

CVE-2026-97925 tick/broadcast: Plug clockevents replacement race

In the Linux kernel, the following vulnerability has been resolved: tick/broadcast: Plug clockevents replacement race 朱恺乾 reported and decoded the following race condition when a broadcast device is replaced: CPUA CPUB tickbroadcastoneshotcontrol bc = tickbroadcastdevice.evtdev;...