NGINX 1.30.0 ngx_http_rewrite_module Heap Buffer Overflow

NGINX versions 0.6.27 through 1.30.0 contain an unauthenticated heap buffer overflow in ngxhttprewritemodule. The supplied proof of concept demonstrates command execution in an ASLR-disabled lab environment. https://packetstorm.news/download/238887...

...[ More ]

Microsoft Windows Ancillary Function Driver for WinSock AFD.sys contains a local privilege escalation vulnerability that allows an attacker to obtain SYSTEM privileges. This C proof-of-concept exploits CVE-2023-21768 through an arbitrary kernel write primitive triggered using the AFDNOTIFYSOCKIOC...

Grafana 8.3.0 Arbitrary File Read

Grafana versions 8.0.0-beta1 through 8.3.0 contain a directory traversal vulnerability that permits unauthenticated arbitrary file read. This proof of concept sends crafted requests to the plugin static-file handler and interactively displays requested target files...

Gogs 0.13.3 Authenticated Symlink Write

Gogs versions 0.13.3 and earlier contain an authenticated symbolic link handling flaw in the PutContents API that can allow writes to service-account-accessible files and remote code execution. https://packetstorm.news/download/238905...

PDF.js 4.1.392 Arbitrary JavaScript Execution

PDF.js version 4.1.392 contains a missing type check in Type 1 font handling that allows arbitrary JavaScript execution in the PDF.js context. This proof of concept generates a crafted PDF using a FontMatrix payload. https://packetstorm.news/download/238893...

PHP 8.4.26 Remote Command Execution

PHP version 8.4.26 contains a session upload-progress handling issue that can be exploited through crafted multipart requests to execute a command. This proof of concept demonstrates the issue in a local Docker lab. https://packetstorm.news/download/238904...

Gitea 28.2.0 Archived Repository Write-Protection Bypass

Gitea version 28.2.0 and prior versions contain a missing archived-repository write check that allows authenticated write collaborators to create, modify, or delete releases, milestones, and labels through the API. https://packetstorm.news/download/238917...

WordPress 7.0.1 REST API Batch Route Confusion Remote Code Execution

WordPress version 7.0.1 contains a REST API batch-route confusion issue which, when chained with an authornotin SQL injection issue, can allow unauthenticated remote code execution. This submission provides a proof of concept report for the wp2shell vulnerability chain...

Sudo 1.9.5p1 Sudoedit Heap Overflow

Sudo version 1.9.5p1 contains a heap-based buffer overflow in sudoedit that may allow local privilege escalation. This incident-response report documents exploitation of CVE-2021-3156 following an SSH compromise. https://packetstorm.news/download/238886...

Log4j Scanner

Log4j Scanner recursively scans supplied log directories for JNDI strings associated with attempts to exploit Apache Log4j CVE-2021-44228. https://packetstorm.news/download/238888...

Apple RawCamera 9420 Canon sRAW Heap Out-Of-Bounds Write

Apple RawCamera version 9420 contains a heap out-of-bounds write in its Canon sRAW decoder. A crafted CR2 proof of concept bypasses geometry validation and causes a negative row step to write before the pixel buffer. https://packetstorm.news/download/238925...

Apple RawCameraSupport 9420 Heap Buffer Overflow

Apple RawCameraSupport version 9420 contains a heap-based buffer overflow in its decoder for compressed Phase One IIQ raw images. A proof of concept IIQ file sets flat-field data to cause correction processing to write past the decoded pixel buffer. https://packetstorm.news/download/238924...

gRPC-Go 1.79.2 :path Authorization Bypass

gRPC-Go versions before 1.79.3 contain an authorization bypass via a malformed HTTP/2 :path header lacking a leading slash. The proof of concept demonstrates bypassing path-based deny rules with a fallback allow rule. https://packetstorm.news/download/238901...

Bolt CMS 5.1.12 Authenticated Remote Code Execution

Bolt CMS version 5.1.12 and earlier contains an authenticated file upload and rename flaw that allows users with ROLEEDITOR privileges to achieve remote code execution. This proof of concept uploads and renames a PHP file through the file manager. https://packetstorm.news/download/238920...

Node.js 24.22.0 Brotli Decoder Remote Code Execution

Node.js version 24.22.0 contains an out-of-bounds write in the Brotli decoder. A proof of concept demonstrates remote code execution through a crafted Brotli-compressed HTTP request. https://packetstorm.news/download/238892...

needrestart Sudo Privilege Escalation

needrestart before version 3.8 allows local attackers to execute arbitrary code as root by causing it to run Python with an attacker-controlled PYTHONPATH environment variable. This proof of concept creates a privileged shell on the affected target. https://packetstorm.news/download/238915...

LXD 6.10.0 Client Certificate Chain Authentication Bypass

Canonical LXD versions 4.0.14, 5.0.10, 5.21.8, and 6.9.0 through 6.10.0, along with affected MicroCloud releases, contain an authentication bypass through unverified client certificate chains. https://packetstorm.news/download/238890...

Brotli 1.2.0 Decoder Heap Out-Of-Bounds Write

Brotli versions 1.0.3 through 1.2.0 contain a heap out-of-bounds read and write in the streaming decoder. Included proof of concept Brotli streams trigger the block-switch parsing flaw. https://packetstorm.news/download/238923...

Apple iOS 27.1 CoreMedia Memory Corruption

Apple iOS version 27.1 CoreMedia contains a memory corruption issue when processing crafted Dolby Vision RPU metadata. The proof of concept submits such metadata through CoreAnimation to backboardd and demonstrates controlled saved-return-address corruption stopped by PAC...

WordPress 7.1.3 Pingback Brotli Decoder Remote Code Execution

A proof of concept demonstrates reaching a vulnerable native Brotli decoder through the WordPress version 7.1.3 pingback path to execute a fixed id command in a local Podman lab. https://packetstorm.news/download/238897...