CVE-2022-0778

CVE-2022-0778 La vulnérabilité découverte déclenche une boucle infinie dans la fonction BNmodsqrt d'OpenSSL lors de l'analyse d'une clé de courbe elliptique. Cela signifie qu'un certificat X.509 malveillant peut provoquer un déni de service sur tout serveur non corrigé. Le cœur de la vulnérabilit...

CVE-2013-3651

CVE-2013-3651 PoC - EC-CUBE 2 Utilisation Prérequis Python 3 Exécution root@kitploit: $ python poccve20133651.py - e.g. $ python poccve20133651.py http://127.0.0.1:9000/ Result: Vulnerable! PoC Vulnérabilité | Construction et rénovation de sites e-commerce – « EC-CUBE » plateforme ouverte EC...

curveball

curveball CVE-2020-0601 curveball - 대체 키 계산기 빌드 Windows Visual Studio 2012 이상에서 솔루션을 빌드하세요. Linux / Unix cc altkey.c -lcrypto -o altkey 사용법 사용법: altkey ecpubliccertificate.pem ecnewprivatekey.pem 예제 root@kitploit: C:\security\curveball\Releasealtkey...

CVE-2021-20717

CVE-2021-20717-EC-CUBE-XSS NVD 설명 EC-CUBE 4.0.0부터 4.0.5까지의 크로스 사이트 스크립팅 취약점으로, 원격 공격자가 EC-CUBE로 생성된 EC 웹 사이트의 특정 입력 필드에 특수하게 조작된 스크립트를 주입할 수 있습니다. 그 결과, 관리자의 웹 브라우저에서 임의의 스크립트가 실행될 수 있습니다. 설정 1. EC-CUBE 클론 root@kitploit: git clone https://github.com/EC-CUBE/ec-cube.git -b 4.0.5 2. Docker 빌드...

Vision-MSI-Thermal-Control

Vision MSI Thermal Control Gestion thermique Linux pour MSI Modern 15H AI C1MG-096IT - Contrôle EC par rétro-ingénierie avec profils de ventilateur et seuil de batterie 🎯 Objectif de ce projet Cette application est née d’un besoin réel des utilisateurs d’ordinateurs portables MSI sous Linux. Tout...

bugstropics

Chasser les bugs sous les tropiques Ce dépôt contient les diapositives utilisées lors de ma présentation « Hunting Bugs in the Tropics » au DEFCON30. Il inclut le script Python utilisé pour calculer le mot de passe de support à partir de la clé privée obtenue en cassant la clé publique EC du...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: leds: led-class: Only add the LED to ledslist when it is fully ready. Before this change, the LED was added to ledslist before the ledinitcore function was called—that is, before ledclassdev.setbrightnesswork was initialized. Thi...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: crosecishtp: Fixed a UAF issue after unbinding the driver. After unbinding the driver, another kthread named crosecconsolelogwork still accesses the device, resulting in a UAF and system crash. The driver does no...

CVE-2026-64420

In the Linux kernel, the following vulnerability has been resolved: mfd: crosec: Delay devsetdrvdata until probe success If ecdeviceprobe fails, crosecclassrelease releases memory for the crosecdev structure. However, because the drvdata was already set, sub-drivers like crosectypec can still...

CVE-2026-64420

In the Linux kernel, the following vulnerability has been resolved: mfd: crosec: Delay devsetdrvdata until probe success If ecdeviceprobe fails, crosecclassrelease releases memory for the crosecdev structure. However, because the drvdata was already set, sub-drivers like crosectypec can still...

CVE-2026-64420 mfd: cros_ec: Delay dev_set_drvdata() until probe success

In the Linux kernel, the following vulnerability has been resolved: mfd: crosec: Delay devsetdrvdata until probe success If ecdeviceprobe fails, crosecclassrelease releases memory for the crosecdev structure. However, because the drvdata was already set, sub-drivers like crosectypec can still...

CVE-2026-64420

Summary : CVE-2026-64420 affects the Linux kernel in the Cros EC (ChromeOS) subsystem. The issue arises during driver probing where dev_set_drvdata() is set before probe success, allowing sub-drivers such as cros_ec_typec to retain a stale pointer to the device even if ec_device_probe() fails. Th...

CVE-2026-64420 mfd: cros_ec: Delay dev_set_drvdata() until probe success

In the Linux kernel, the following vulnerability has been resolved: mfd: crosec: Delay devsetdrvdata until probe success If ecdeviceprobe fails, crosecclassrelease releases memory for the crosecdev structure. However, because the drvdata was already set, sub-drivers like crosectypec can still...

Linux Distros Unpatched Vulnerability : CVE-2026-64420

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mfd: crosec: Delay devsetdrvdata until probe success If ecdeviceprobe fails, crosecclassrelease releases memory for the crosecdev structure. However, because th...

openstack-keystone: OpenStack Keystone: Privilege escalation through EC2 credential creation

A flaw was found in OpenStack Keystone. An authenticated user with a reader role can exploit a vulnerability in the EC2 credential creation endpoint. By using a restricted application credential to call the EC2 credential creation API, the user may obtain EC2/S3 credentials that carry the full se...

MAL-2026-6996 Malicious code in ec-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc8245936c8beb04bdb2bfe31a8117133823e3ffd6ed3e165d89b822dfab4a9c package.json declares a preinstall script that runs npm install @sentry/node && node examples/verify.js. examples/verify.js initializes the package's...

EulerOS 2.0 SP15 : kernel (EulerOS-SA-2026-2444)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : crypto: algifaead - Revert to operating out-of-placeCVE-2026-31431 bpf: Fix undefined behavior in interpreter sdiv/smod for INTMINCVE-2026-31525...

CVE-2026-54419

PIAF-HMS (PBX-In-A-Flash Hotel Management System) contains multiple unauthenticated SQL injection vulnerabilities. The app has no authentication and passes user-supplied HTTP parameters directly into deprecated mysql_query() calls via string concatenation, without sanitization, escaping, or param...

Siemens RUGGEDCOM RST2428P Improper Input Validation (CVE-2025-40263)

In the Linux kernel, the following vulnerability has been resolved: Input: croseckeyb - fix an invalid memory access If croseckeybregistermatrix isn't called due to buttonsswitchesonly in croseckeybprobe, ckdev-idev remains NULL. An invalid memory access is observed in croseckeybprocess when...

Security update for libjxl (important)

openSUSE Security Update: Security update for libjxl Announcement ID: openSUSE-SU-2026:0182-1 Rating: important References: 1266460 Cross-References: CVE-2025-70103 CVSS scores: CVE-2025-70103 SUSE: 9.2 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Affected Products: openSUSE...