CVE-2025-27363-proof-of-concept

Proof-of-concept for CVE-2025-27363 that crashes FreeType 2.13.0. This modifies Roboto Flex, a variable font, so that the "%" character glyph 8 is now a composite glyph with 0xfffd subglyphs. Rendering the edited font with FreeType 2.13.0 the last version before the fix crashes, with ASAN detecti...

CVE-2017-8570

What? This repo contains a Proof of Concept exploit for CVE-2017-8570, a.k.a the "Composite Moniker" vulnerability. This demonstrates using the Packager.dll trick to drop an sct file into the %TEMP% directory, and then execute it using the primitive that the vulnerability provides. Why? A few...

CVE-2017-8570

What? This repo contains a Proof of Concept exploit for CVE-2017-8570, a.k.a the "Composite Moniker" vulnerability. This demonstrates using the Packager.dll trick to drop an sct file into the %TEMP% directory, and then execute it using the primitive that the vulnerability provides. Why? A few...

Pi-Zero-2W-Bad-USB

Raspberry Pi Zero 2 W BadUSB HID Toolkit A programmable BadUSB / HID attack platform built on a Raspberry Pi Zero 2 W. The Pi enumerates as a USB composite device keyboard plus an optional read-only mass-storage volume and executes Ducky-Script-style payloads against the host it's plugged into...

CVE-2017-8570

来源：https://www.exploit-db.com/exploits/44263/ 使用方法：python packagercompositemoniker.py -s calc.sct -o example.rtf What? This repo contains a Proof of Concept exploit for CVE-2017-8570, a.k.a the "Composite Moniker" vulnerability. This demonstrates using the Packager.dll trick to drop an sct file...

psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry

Summary PSDImage.composite and .numpy allocate the output image buffer from the PSD's header geometry width × height × channels × depth, and per-layer rectangles before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte...

GHSA-8Q6G-VJHF-JP8M psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry

Summary PSDImage.composite and .numpy allocate the output image buffer from the PSD's header geometry width × height × channels × depth, and per-layer rectangles before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte...

CVE-2026-59991 psd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometry

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite and PSDImage.numpy allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those value...

keycloak-services: keycloak-services: Missing per-role authorization on RoleContainerResource composite endpoints

A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remov...

keycloak-services: keycloak-services: Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles

A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can...

Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

Summary The security issue described in CVE-2026-16190, CVE-2026-15887, CVE-2026-15412, CVE-2026-16435, CVE-2026-15396, CVE-2026-15634, CVE-2026-16185, CVE-2026-10841, CVE-2026-11548, CVE-2026-11549, CVE-2026-11722, CVE-2026-9327, CVE-2026-9667, CVE-2026-9338, CVE-2026-16188, CVE-2026-9176,...

Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed WebSphere Application Server is affected by a privilege escalation (CVE-2026-11545)

Summary The security issue described in CVE-2026-11545 has been identified in WebSphere Application Server included as part of IBM Tivoli Composite Application Manager for Application Diagnostics Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affecte...

Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed WebSphere Application Server is affected by an HTTP request smuggling vulnerability (CVE-2026-11710)

Summary The security issue described in CVE-2026-11710 has been identified in WebSphere Application Server included as part of IBM Tivoli Composite Application Manager for Application Diagnostics Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affecte...

Astra Linux – Vulnerability in openexr

OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf31::LineCompositeTask::execute called from IlmThread31::NullThreadPoolProvider::addTask and IlmThread31::ThreadPool::addGlobalTask. NOTE: db217f2 may be inapplicable...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: usb: gadget: Fixed a use-after-free in compositedevcleanup. 1. In func configfscompositebind - compositeosdescreqprepare: If kmalloc fails, the pointer cdev-osdescreq will be freed but will not be set to NULL. As a result, the...

Astra Linux – Vulnerability in Linux, Linux 5.10

A issue was discovered in the drivers/usb/gadget/composite.c file within the Linux kernel before version 5.16.10. The USB Gadget subsystem lacks certain validations for interface OS descriptor requests those with a large array index and those associated with NULL function pointer retrieval. Memor...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: ep0: fix NULL pointer exception There is no validation of the index from dwc3wIndextodep, and we might be referring to a non-existent ep, triggering a NULL pointer exception. In certain configurations, we might use few...

BIT-KEYCLOAK-2026-16106 Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles

A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can...

BIT-KEYCLOAK-2026-16105 Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints

A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remov...

CVE-2026-81853 AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashadmin turns a record-lookup URL into an equality oracle over sensitive attributes. AshAdmin.Helpers.decodeprimarykey/2 decodes the composite-primary-key form Base64 plus ETF and returns the decoded map verbatim as th...