witchcraft

🎉 你的OPSEC伴侣。运行witchcraft help或witchcraft manual（获取完整手册）🎉 它能做什么？ WITCHCRAFT不仅仅是一个简单的别名，它是一个初始化系统，可以与busybox、shell和自动化引擎配合使用，用于黑客、OSINT、取证等。 名称 witchcraft - 一款多功能的网络安全工具包。 概要 witchcraft MODULENAME OPTION... FILE... IP... 描述 WITCHCRAFT...

research

Security Research Repository dedicated to my security vulnerability discoveries CVEs. This repository contains detailed technical documentation, proof-of-concept exploits, and analysis of discovered vulnerabilities. About This repository aggregates all CVEs I have discovered and researched,...

ROOT-OS-ALPINE-317-CVE-2022-48174 CVE-2022-48174 in busybox - Patched by Root

Root has patched CVE-2022-48174 in the busybox package for Root:Alpine:3.17. Multiple fixed versions available...

ROOT-OS-ALPINE-315-CVE-2022-48174 CVE-2022-48174 in busybox - Patched by Root

Root has patched CVE-2022-48174 in the busybox package for Root:Alpine:3.15. Multiple fixed versions available...

CVE-2025-60876

CVE-2025-60876: corrección de inyección en request-target de busybox wget Una corrección que preserva el comportamiento para CVE-2025-60876, una vulnerabilidad de inyección de cabeceras HTTP en BusyBox wget, junto con la prueba de concepto que la demuestra y los artefactos para enviar la correcci...

CVE-2014-0196

See https://vulners.com/cve/CVE-2014-0196...

Linux Distros Unpatched Vulnerability : CVE-2026-88841

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - busybox - None CVE-2026-88841 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, In...

busybox: busybox: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...

busybox: busybox: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb packages

BusyBox dpkg readpackagefield steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: busybox: busybox-1.37.0-9.1.hum1 aarch64, x8664 busybox-petitboot-1.37.0-9.1.hum1 aarch64, x8664 busybox-shared-1.37.0-9.1.hum1 aarch64, x8664 busybox-1.37.0-9.1.hum1.src src Security Fixes:...

busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint

BusyBox passwd/group tokenize references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers...

busybox: busybox: romfs volume ID parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images...

busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

Linux Distros Unpatched Vulnerability : CVE-2026-88831

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients. CVE-2026-88831 No...

Linux Distros Unpatched Vulnerability : CVE-2026-88835

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox dpkg readpackagefield steps past a NUL terminator on malformed .deb packages, causing an out- of-bounds heap read. CVE-2026-88835 Note that Nessus relie...

Linux Distros Unpatched Vulnerability : CVE-2026-88830

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-88840

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox TLS getclienthello reads past the end of the input buffer when parsing a truncated ClientHello message. CVE-2026-88840 Note that Nessus relies on the...

Linux Distros Unpatched Vulnerability : CVE-2026-88839

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox passwd/group tokenize references a stale endpoint pointer after trimming, causing an out-of- bounds write of heap pointers. CVE-2026-88839 Note that...

Linux Distros Unpatched Vulnerability : CVE-2026-88832

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images...

Linux Distros Unpatched Vulnerability : CVE-2026-88837

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check. CVE-2026-88837 Note that Nessus...