CVE-2023-40459

Introducción Este repositorio contiene el PoC de la vulnerabilidad CVE-2023-40459. Esta vulnerabilidad afecta al archivo ACEManager en las versiones ALEOS 4.16 y anteriores, un producto de Sierra Wireless. Este ataque, sin ningún derecho de acceso inicial, puede provocar una interrupción en el...

CVE-2004-0558

这是针对CVE-2004-0558的概念验证利用程序 特定版本的CUPs（1.1.x）在接收到零长度UDP数据包时存在拒绝服务漏洞 https://www.exploit-db.com/exploits/24599/ 值得注意的是，使用nmap也可以实现此攻击，该利用程序仅用于研究和教育目的。 用法： python kill-cups.py -t 192.168.1.91 附加的命令行标志仅用于研究目的。UDP要求数据包头部使用任意源端口。在利用程序中，我默认将其设置为4321，但如有必要可以更改。 python kill-cups.py -t 192.168.1.91...

WarChild

War Child Warchild は、あなたのウェブサイトの耐性を分析するためのDoS（サービス拒否）テストスイートです。主に犯罪者によって組織され、ウェブサイトに損害を与えるために行われるさまざまな種類のサービス拒否攻撃に対する分析を行います。 インストール root@kitploit: 必要なモジュールをインストールするには、ターミナルで以下のコマンドを実行するだけです : pip install -r requirements.txt 使用方法 root@kitploit: python warchild.py 概要 このDoSスイートは、以下の機能を備えています： 1...

CVE-2024-48914

这篇文章是由 EQSTLab 发布的研究文章。 感谢发现该漏洞的Rajesh Sharma。 CVE-2024-48914 ★ CVE-2024-48914 任意文件读取与 DoS PoC ★ 描述 CVE-2024-48914：vendure-ecommerce 任意文件读取与 DoS 漏洞 描述：Vendure 是一个开源的无头（headless）电商平台。在 3.0.5 和 2.3.3 版本之前，Vendure 的 asset server...

kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush()

A flaw was found in the Linux kernel's block input/output control group blk-cgroup component. This vulnerability, a Use-After-Free UAF, occurs when multiple block control groups are released at the same time. A race condition allows one group to remove another's entries while it is still in use,...

kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove

A flaw was found in the Linux kernel's qrtr network subsystem. A race condition exists in the qrtrportremove function where the socket reference count is decremented prematurely. This allows a concurrent reader to access a socket whose reference count has dropped to zero, potentially leading to a...

kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32

A flaw was found in the Linux kernel's Fibre Channel FC transport component. An adjacent Fibre Channel fabric actor, such as a compromised switch or fabric controller, can send a specially crafted FPIN ELS Fabric Performance Incentive Notification Extended Link Service frame. This malformed frame...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb

A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. This use-after-free vulnerability arises from incorrect handling of fast-RX rate data during mesh processing. This can lead to memory corruption, which an attacker could potentially exploit to cause a system crash denial of service...

kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash

A flaw was found in the ath9k Wi-Fi driver in the Linux kernel. A race condition exists during the asynchronous firmware loading process and device disconnection. A local attacker, by repeatedly connecting and disconnecting a malicious USB Wi-Fi device that fails firmware download, could trigger ...

kernel: wifi: nl80211: reject oversized EMA RNR lists

A flaw was found in the Linux kernel's nl80211 Wi-Fi subsystem. The nl80211parsernrelems function, responsible for parsing EMA RNR Enhanced Multiple Access Reduced Neighbor Report lists, does not properly handle an excessive number of nested NL80211ATTREMARNRELEMS inputs. This improper input...

aiodnsbrute

非同期DNSブルートフォース Python 3.5+ で動作し、asyncio を使用して非同期にドメイン名をブルートフォースするツールです。 速度 高速です。 小規模なVPSホストでのベンチマークでは、約10万件のDNS解決が1.5～2分でした。Amazon M3インスタンスでは、100万件のリクエストをわずか3分強で処理しました。実際の速度は環境によります。速度だけを重視するなら、Googleのリゾルバーの使用は避けたほうがいいでしょう。 免責事項...

CVE-2026-91752

GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the processstaroffice function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing...

kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32

A flaw was found in the Linux kernel's Fibre Channel FC transport component. An adjacent Fibre Channel fabric actor, such as a compromised switch or fabric controller, can send a specially crafted FPIN ELS Fabric Performance Incentive Notification Extended Link Service frame. This malformed frame...

kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove

A flaw was found in the Linux kernel's qrtr network subsystem. A race condition exists in the qrtrportremove function where the socket reference count is decremented prematurely. This allows a concurrent reader to access a socket whose reference count has dropped to zero, potentially leading to a...

kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash

A flaw was found in the ath9k Wi-Fi driver in the Linux kernel. A race condition exists during the asynchronous firmware loading process and device disconnection. A local attacker, by repeatedly connecting and disconnecting a malicious USB Wi-Fi device that fails firmware download, could trigger ...

kernel: wifi: nl80211: reject oversized EMA RNR lists

A flaw was found in the Linux kernel's nl80211 Wi-Fi subsystem. The nl80211parsernrelems function, responsible for parsing EMA RNR Enhanced Multiple Access Reduced Neighbor Report lists, does not properly handle an excessive number of nested NL80211ATTREMARNRELEMS inputs. This improper input...

kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush()

A flaw was found in the Linux kernel's block input/output control group blk-cgroup component. This vulnerability, a Use-After-Free UAF, occurs when multiple block control groups are released at the same time. A race condition allows one group to remove another's entries while it is still in use,...

CVE-2019-13288

CVE-2019-13288 – Xpdf 的 Parser::getObj 中的无限递归 概述 CVE-2019-13288 是在 Xpdf 4.01.01 版本中发现的漏洞，具体位于 Parser.cc 的 Parser::getObj 函数中。此缺陷在处理特制的 PDF 文件时可能导致 无限递归 ，进而引发 拒绝服务 DoS 条件。该漏洞类似于 CVE-2018-16646 ，凸显了在递归函数中进行稳健输入验证的重要性。 技术细节 CVE 编号 ：CVE-2019-13288 受影响软件 ：Xpdf 4.01.01 漏洞类型 ：不受控递归 CWE-674 影响 ：拒绝服务 DoS...

CVE-2024-23722-poc

CVE-2024-23722-poc 使用方法 root@kitploit: python3 exploit.py http://127.0.0.1:8888 port is currently not open port is currently not open port is currently not open port is currently not open Server might have crashed port is currently not open port is currently not open port is currently not open...