stack-overflow-poc

CVE-2018-12086 PoC https://nvd.nist.gov/vuln/detail/CVE-2018-12086 https://opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2018-12086.pdf TL;DR: certaines piles OPC UA sont vulnérables à un débordement de pile lors du décodage de requêtes spécialement conçues...

CVE-2019-0708

CVE-2019-0708 CVE-2019-0708 python3 check 0708 Une vulnérabilité d'exécution de code à distance existe dans les services Bureau à distance – anciennement connus sous le nom de services Terminal Server – lorsqu'un attaquant non authentifié se connecte au système cible en utilisant RDP et envoie de...

webp_server_go 0.4.0 - Path Traversal

webpservergo 0.4.0 contains a path traversal caused by insufficient sanitization in file handling, letting attackers read arbitrary files on the server, exploit requires attacker to send crafted requests. id: CVE-2021-46104 info: name: webpservergo 0.4.0 - Path Traversal author: pikpikcu severity...

CVE-2023-29489

CVE-2023-29489 Эта уязвимость зафиксирована в системе Common Vulnerabilities and Exposures CVE. Она связана с cPanel — популярным программным обеспечением для управления хостингом. Данная ошибка позволяет проводить межсайтовые атаки XSS с помощью специально созданных запросов. Детали о...

CVE-2024-36401_Geoserver_RCE_POC

⚠️ Avertissement : Cet outil est destiné uniquement à la recherche en sécurité et aux tests autorisés légalement. Ne l'utilisez pas à des fins illégales. L'utilisateur assume l'entière responsabilité juridique. Version du README : English | 中文 Description de la vulnérabilité Ce script est un outil...

CVE-2022-22947-POC

Spring-Cloud-Gateway-CVE-2022-22947 Spring Cloud Gateway — объявление об уязвимости удалённого выполнения кода. Данная уязвимость возникает, когда в Spring Cloud Gateway включена и доступна конечная точка Gateway Actuator; приложения, использующие Spring Cloud Gateway, могут быть подвержены...

FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests

A flaw was found in FreeRDP. When smartcard emulation is enabled, a remote attacker can send specially crafted smartcard cache requests to a FreeRDP client. This can lead to a null pointer dereference, causing the client process to terminate and disrupting active remote desktop sessions...

CVE-2025-55182

Strumento di rilevamento e sfruttamento della vulnerabilità CVE-2025-55182 Introduzione al progetto Questo strumento è un'applicazione GUI sviluppata con Java Swing per rilevare e sfruttare la vulnerabilità CVE-2025-55182. Tale vulnerabilità è un difetto di sicurezza nel framework Next.js che...

Astra Linux – Vulnerability in json-smart

A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4, which causes a denial of service DOS through a crafted web request...

Astra Linux – Vulnerability in dcmtk

DCMTK through version 3.6.6 does not handle memory deallocation properly. The malloc function allocates heap memory for data parsing, but does not deallocate that memory when there are errors in parsing. Sending specific requests to the dcmqrdb program leads to memory leaks. An attacker can use...

Directory Traversal

Overview org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration. Affected versions of this package are vulnerable to Directory Traversal via the native environment repository process. An attacker can access sensitive...

HTTP Response Splitting

Overview Affected versions of this package are vulnerable to HTTP Response Splitting in the processing of HTTP headers. An attacker can inject or manipulate HTTP headers by sending specially crafted requests. Remediation Upgrade org.springframework.cloud:spring-cloud-function-web to version 5.0.4...

EUVD-2026-60735

An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service...

Unchecked Input for Loop Condition

Overview Affected versions of this package are vulnerable to Unchecked Input for Loop Condition via unchecked input for the loop condition in the System.Net.WebSockets. An attacker can cause a denial of service by sending specially crafted network requests that trigger excessive resource...

X.org: xorg-x11-server: GLX contextTags Use-After-Free in CommonMakeCurrent()

A flaw was found in the X.org X11 server, specifically within the GLX OpenGL Extension to the X Window System dispatch layer. A remote attacker can exploit this vulnerability by sending a series of crafted X11 requests. This can lead to a use-after-free condition, where the server attempts to wri...

DEBIAN-CVE-2026-43628

llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dryallowedlength set to INT32MIN to the /v1/completions or...

CVE-2026-8183 Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot "...

micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests

A flaw was found in Micrometer. A remote attacker can provide specially crafted HTTP requests, which may lead to a denial-of-service DoS condition. This vulnerability allows an attacker to disrupt the availability of the affected system...

CVE-2026-71201

In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another project...

EUVD-2026-52968

An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via crafted CreateSubscription, CreateMonitoredItemsSampling, Publish, TransferSubscriptions, and DeleteSubscriptions requests...