Java-Compressed-file-security

Java-Compressed-file-security java web уязвимость безопасности сжатых файлов Тестовая среда: root@kitploit: Windows For Apache Tomcat/8.5.16 0x01 Создание вредоносного сжатого файла с обходом каталога Код: root@kitploit: coding=utf-8 import zipfile import sys if name == "main": try: with...

pgpdump

pgpdump: ein PGP-Paket-Visualizer Kazu Yamamoto [email protected] 16. August 2010 Übersicht pgpdump ist ein PGP-Paket-Visualizer, der das Paketformat von OpenPGP RFC 4880 und PGP Version 2 RFC 1991 anzeigt. Hier ist ein Beispiel: root@kitploit: % pgpdump test/sig1 Old: Marker Packettag 103...

plugxdecoder

plugxdecoder Einfaches Python-Skript, das PlugX-Verkehr und verschlüsselte/komprimierte Artefakte dekodiert. Pull-Requests von denen, die beitragen möchten, werden akzeptiert. Derzeit benötigt: CTypes mit ntdll, dpkt http://code.google.com/p/dpkt Getestet mit Python 2.7 unter Windows. Langfristig...

cve-2020-0796

CVE-2020-0796 вызвана ошибкой в протоколе SMBv3 при обработке вредоносных сжатых пакетов: при распаковке пакета используется длина, переданная клиентом, без проверки её корректности, что в итоге приводит к целочисленному переполнению. Уязвимость позволяет удалённому неаутентифицированному...

CVE-2022-25581

CVE-2022-25581 Im gesamten Internet nicht auffindbar – hier als Backup hinterlegt. Python-Exploit-Skript zur automatischen Durchführung der folgenden Schritte: ✅ Ziele des Skripts 1. Im Backend anmelden csrf und token abrufen 2. Ein bösartiges Request-Paket konstruieren, um ein Archiv mit Webshel...

imbyter-WinRAR_CVE-2023-38831

💥 Descrizione della vulnerabilità WinRAR CVE-2023-38831 Nelle versioni di WinRAR precedenti alla 6.23 esiste una vulnerabilità di estensione file ingannevole. Un attaccante può sfruttare questa vulnerabilità creando un archivio compresso speciale contenente file apparentemente innocui, come...

Demonstration-of-CVE-2023-38831-via-Reverse-Shell-Execution

CVE-2023-38831 Reverse-Shell-Demonstration Dieses Repository enthält eine PDF-Zusammenfassung und Screenshots einer laborbasierten Demonstration von CVE-2023-38831. Die Schwachstelle ermöglicht es Angreifern, schädliche Payloads in komprimierte Dateien einzubetten und auszuführen. In diesem Fall...

CVE-2025-0411-PoC

अधिक PoC देखें: https://pc.fenchuan8.com//index?forum=101158&yqm=DGR4X MinGW-w64 का उपयोग करके cpp संकलन करें x8664-w64-mingw32-g++ loader.cpp -o loader.exe -s -static संकलन के बाद exe को 7z से संपीड़ित करें और दो बार निष्पादित करें चूँकि इस भेद्यता के लिए उपयोगकर्ता की सहभागिता आवश्यक है, इसलिए...

EUVD-2026-37014

gRPC Erlang package has unbounded gzip decompression decompression bomb...

miteru

This repository does not have a README...

EUVD-2026-61174

Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. To remediate this issue,...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid updating compression context during writeback Bai, Shuangpeng reported a bug as below: Oops: divide error: 0000 1 SMP KASAN PTI CPU: 0 UID: 0 PID: 11441 Comm: syz.0.46 Not tainted 6.17.0 1 PREEMPTfull Hardware...

EUVD-2026-54179

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator that allows authenticated attackers to cause a denial of service by storing a crafted compressed datum with an internally inconsistent BitArray...

Important: Red Hat Security Advisory: libtiff security update

An update for libtiff is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies

A flaw was found in httplib2, a Python HTTP client library. This vulnerability allows a malicious or compromised HTTP server to send a small compressed data payload that, when decompressed by httplib2, expands to an extremely large size in memory. This unbounded decompression can lead to a Denial...

httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies

A flaw was found in httplib2, a Python HTTP client library. This vulnerability allows a malicious or compromised HTTP server to send a small compressed data payload that, when decompressed by httplib2, expands to an extremely large size in memory. This unbounded decompression can lead to a Denial...

thrift: Apache Thrift Python bindings: Denial of Service via data amplification

A flaw was found in Apache Thrift Python bindings. This vulnerability involves the improper handling of highly compressed data, leading to a data amplification issue. An attacker could exploit this by providing specially crafted compressed input, which may cause the application to consume excessi...

CVE-2026-68981

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

CVE-2026-59881 AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory...

CVE-2026-59881 AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory...