openssl: untrusted sender DN used as format string in CMP response validation

A flaw was found in OpenSSL. A malicious CMP Certificate Management Protocol endpoint can send an unexpected distinguished name DN directly as the format string argument to ERRraisedata, causing the application to dereference and write to unrelated stack contents. This can lead to a crash in the...

Important: Red Hat Security Advisory: openssl security, bug fix, and enhancement update

An update for openssl is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

RTOS-F-16-Exploit---CVE-2019-7711

Exploit del RTOS INTEGRITY de Green Hills para F-16 - CVE-2019-7711 Cadena completa de explotación de format string Ataque realista de mantenimiento en tierra contra la aviónica del F-16 📋 Descripción Este repositorio contiene una Prueba de Concepto PoC para CVE-2019-7711 — una vulnerabilidad de...

SSH-Remote-Code-Execution

SSH Remote Code Execution SSH Zero-Day | Made by ClumsyLulz & Taylor Christian Newsome Summary This repository contains a C program that accepts input parameters and generates a packet to be sent to a server over the SSH protocol. The program allocates a buffer to hold the data, writes it to a...

CVE-2023-35086-POC

CVE-2023-35086-POC July 25 2023, Altin tin-z, github.com/tin-z Breve descripción Los firmwares de los routers ASUS RT-AX56U V2 y RT-AC86U, con versiones iguales o inferiores a 3.0.0.4.38650460 y 3.0.0.438651529 respectivamente, tienen una vulnerabilidad de formato de cadena en la función detwan.c...

CVE-2024-29510

Original research and POC code: https://codeanlabs.com/blog/research/cve-2024-29510-ghostscript-format-string-exploitation/ NOTE: I have made no changes to the POC apart from the command executed. Full credit goes to Thomas Rinsma @ Codean Labs for their amazing research and POC. Local Scenario 1...

GLUFS

Getting Leaks Using Format String. root@kitploit: .d8888b. 888 888 888 8888888888 .d8888b. d88P Y88b 888 888 888 888 d88P Y88b 888 888 888 888 888 888 Y88b. 888 888 888 888 8888888 "Y888b. 888 88888 888 888 888 888 "Y88b. 888 888 888 888 888 888 "888 Y88b d88P 888 Y88b. .d88P 888 Y88b d88P...

username-anarchy

Username Anarchy Version: 0.6 20 September 2024 Author: urbanadventurer Andrew Horton Homepage: https://www.morningstarsecurity.com/research/username-anarchy Source: https://github.com/urbanadventurer/username-anarchy/ License: MIT Description Tools for generating usernames when penetration...

doona

Doona - herramienta de fuzzing de red .:: Acerca de ::. Doona es un fork de la herramienta Bruteforce Exploit Detector Tool BED. BED es un programa diseñado para comprobar daemons en busca de posibles desbordamientos de búfer, errores de cadena de formato, etc. Doona es el término australiano par...

perl_spreadsheet_excel_rce_poc

ParseExcel security vulnerabilitiy TL;DR: RCE from logic in parsing format strings. Short explanation on the exploit Root cause of the exploitation comes from calling eval to an unvalidated user input in Utility.pm...

CVE-2019-11287

CVE-2019-11287: DoS via Heap Overflow in RabbitMQ Web Management Plugin Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is...

MC-Log4j-Patcher

MC-Log4J-Patcher El objetivo de este proyecto es proporcionar a los jugadores de Minecraft y a los propietarios de servidores tranquilidad con respecto a la vulnerabilidad Log4J descubierta recientemente CVE-2021-44228. Actualmente, este proyecto busca cualquier cadena de formato Log4J, no solo...

CVE-2026-6643

CVE-2026-6643 — ASUSTOR ADM 5.1.2 RCE Cadena de formato CWE-134 + Desbordamiento de búfer de pila CWE-121 en vpnupload.cgi Resumen de la vulnerabilidad...

CVE-2019-7711

🛡️ CVE-2019-7711: Green Hills INTEGRITY RTOS 信息泄露 📌 关于 Green Hills INTEGRITY RTOS v5.0.4 Telnet 服务器中 格式化字符串 漏洞的技术文档和资源仓库。 📖 概述 该漏洞影响 Green Hills INTEGRITY RTOS 5.0.4 中 Interpeak 的 IPCOMShell Telnet 服务器，其中一个未文档化的命令解释器允许配置命令输入的值。该值直接被用作 printf 函数的输入，未经任何验证 ，从而允许执行恶意格式化字符串。 🔍 影响 ✅ 严重信息泄露...

CVE-2026-42804

A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPIC-Library in versions up to and including commit d6b200416a. The vulnerability is located within the FIFO parsing and debug logging subsystem inside the function bhi360parsedebugmessage in bhi360parse.c line...

EUVD-2026-75329

A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPIC-Library in versions up to and including commit d6b200416a. The vulnerability is located within the FIFO parsing and debug logging subsystem inside the function bhi360parsedebugmessage in bhi360parse.c line...

CVE-2026-42804

A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPIC-Library in versions up to and including commit d6b200416a. The vulnerability is located within the FIFO parsing and debug logging subsystem inside the function bhi360parsedebugmessage in bhi360parse.c line...

CVE-2026-42804

A stack-based buffer overflow exists in the Bosch Sensortec BHI360 SensorAPI (C-Library) , affecting versions up to and including commit d6b200416a. The flaw is in bhi360_parse_debug_message() (bhi360_parse.c, lines 1852–1875), where the first payload byte of a debug frame is used as a length and...

CVE-2026-3008

CVE-2026-3008 — Notepad++ 8.9.3 Format String Injection via nativeLang.xml Vulnerability When a search operation produces results, sub1400916C0 formats a hit count label by retrieving a localized string from nativeLang.xml and passing it directly as the format string to wsprintfW: root@kitploit:...

Palo Alto Networks PAN-OS 9.0.x < 9.0.7 / 9.1.x < 9.1.2 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 9.0.x prior to 9.0.7 or 9.1.x prior to 9.1.2. It is, therefore, affected by a vulnerability. A format string vulnerability in the Varrcvr daemon of PAN-OS on PA-7000 Series devices with a Log Forwarding Card LFC allows remote...