PoC-Exploit-CVE-2024-20467

Exploit para la vulnerabilidad en Cisco IOS XE CVE-2024-20467 Descripción general Este exploit se dirige a una vulnerabilidad en el código de ensamblaje de fragmentos IPv4 presente en Cisco IOS XE Software. La vulnerabilidad permite a un atacante remoto no autenticado provocar una condición de...

W3 Total Cache <= 2.9.3 - Unauthenticated Dynamic Security Token Disclosure

The W3 Total Cache WordPress plugin through version 2.9.3 skips its entire output buffering and processing pipeline whenever an incoming request's User-Agent header contains the string "W3 Total Cache", without authenticating the caller. On sites that use developer-placed dynamic fragment tags, t...

Solara <1.35.1 - Local File Inclusion

A Local File Inclusion LFI vulnerability was identified in widgetti/solara, in version 1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. ...

Broken-Vulnerable-Code-Snippets

Vulnerable-Code-Snippets Una colección de fragmentos de código vulnerables tomados de Internet. Fragmentos extraídos de varios blogs, libros, recursos, etc. Sin intención de infringir derechos de autor. Nota: Esto no es un buen benchmark para probar herramientas de análisis estático; son fragment...

DirtyFrag-for-dummies

Dirty Frag / CVE-2026-43284 — 研究笔记 概述 该仓库包含一个经过清理的技术示意图和辅助笔记，用于描述通常被称为 Dirty Frag 且针对 xfrm-ESP 路径被追踪为 CVE-2026-43284 的 Linux 内核漏洞。 该问题属于由 Hyunwoo Kim（@v4bel）发现的更广泛的 Dirty Frag 类别。一个相关的 RxRPC 变体被单独追踪为 CVE-2026-43500 。 本材料的目的是： 在系统层面解释漏洞机制； 记录 XFRM ESP、UDP 封装、splice、skb 片段、文件支持页以及页缓存损坏之间的关系；...

Linux Distros Unpatched Vulnerability : CVE-2026-47890

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments. Spring Framework 7.0.0 - 7.0.8...

Dirty-Frag

💥 CVE-2026-43284 — Dirty Frag 💥 ⚡ Prueba de Concepto de Escalada de Privilegios Local de Dirty Frag ⚡ 📖 Descripción Este repositorio contiene una Prueba de Concepto PoC para: CVE-2026-43284 — Dirty Frag El exploit demuestra una vulnerabilidad que afecta a sistemas Linux vulnerables. 🧠 Acerca de...

AZL-98117 CVE-2026-80590 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: inet: frags: strip GSO state from fragments before reassembly A virtionethdr tun/tap, or AFPACKET with PACKETVNETHDR can mark an IPv4 or IPv6 fragment as GSO; nothing relates gsotype to fragoff...

Linux Distros Unpatched Vulnerability : CVE-2026-80590

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - inet: frags: strip GSO state from fragments before reassembly A virtionethdr tun/tap, or AFPACKET with PACKETVNETHDR can mark an IPv4 or IPv6 fragment as GSO;...

CVE-2026-47890

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

CVE-2026-47890

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

EUVD-2026-66858

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

CVE-2026-47890

Spring Framework versions 7.0.0–7.0.8 and 6.2.0–6.2.19 are affected by a stream corruption issue when Server-Sent Events (SSE) are used with view fragments in Spring MVC and WebFlux applications. The NVD-assigned CVSS 3.1 score is 9.8 (Critical) , while the vendor (Spring) classifies it as LOW se...

CVE-2026-74747

CVE-2026-74747 affects the Linux kernel in the ipvs (IP Virtual Server) subsystem, specifically in ip_vs_nat_icmp() . After reading embedded IP headers from skb frags, the ihl field is not revalidated; a local process can modify it so that after skb_ensure_writable() a larger value is visible, ca...

CVE-2026-74665

A flaw was found in the Linux kernel. Incorrect length accounting for skb socket buffer fragments after an eXpress Data Path XDP program adjusts the fragment area can lead to an out-of-bounds read. This allows an attacker to potentially disclose sensitive kernel pointers and corrupt user-space...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: In the net subsystem, a leak in the skbtstamptx function was fixed. Commit 50749f2dd685 “tcp/udp: Fixed memory leaks in sk and zerocopy skbs during TX timestamping” added a call to skborphanfragsrx, to fix leaks related to zeroco...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags The MSGSPLICEPAGES function can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFLSHAREDFRAG after skbsplicefromiter, so later processes that may modi...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: skbuff: Fixed a race condition between coalescing and releasing SKBs. The commit 1effe8ca4e34 “skbuff: fixing coalescing for pagepool fragment recycling” allowed coalescing to proceed with non-page pool pages when @from is cloned...

Astra Linux – Vulnerability in Samba

A flaw was discovered in the way Samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request and chose to fragment it, an attacker could replace the later fragments with their own data, thereby bypassing the signature requirements...

Astra Linux – Vulnerability in Linux

A issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept second or subsequent broadcast fragments even when sent in plaintext and process them as fully unfragmented frames. An adversary can exploit this vulnerability to inject arbitrary...