ROS-20261006-73-0414

The vulnerability in the kernel-lt is related to the insufficient use of the assert function. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

CVE-2014-4140

一些粗略笔记 0:007 u MSHTML!CHtmRootParseCtx::AddText+0x104: 6efff0a5 8b8e88000000 mov ecx,dword ptr esi+88h 6efff0ab 898d70ffffff mov dword ptr ebp-90h,ecx 6efff0b1 8945ac mov dword ptr ebp-54h,eax 6efff0b4 8b5118 mov edx,dword ptr ecx+18h 6efff0b7 8bca mov ecx,edx 6efff0b9 83e103 and ecx,3 6efff0bc...

EUVD-2026-26838

Langflow: Prompt injection in Langflow Smart Transform can lead to code execution...

CVE-2018-20343

CVE-2018-20343 これは、Ken SilvermanのBuild Engineにおける脆弱性CVE-2018-20343のPoCです。 生成された.mapファイルはバッファオーバーフローを引き起こし、以下に示すようにスタックを上書きします。 DosBox 0.74-2上のOpen Watcom: 解析者がスタックを制御する FreeDos 1.2上: 解析者がEIPを制御する 脆弱なコードはENGINE.Cにあります: 1935 kreadfil,&numsectors,2; 1936 kreadfil,&sector0,sizeofsectortypenumsectors;...

CVE-2026-14871

CVE-2026-14871 - osTicket ajax.tickets.php 中的 BOLA / IDOR 漏洞 对象级授权失效 BOLA：不安全的直接对象引用 IDOR include/ajax.tickets.php → viewField 函数 由 @JF0x0r 报告 · 2026年3月27日 状态：已修复 - 修复已在 osTicket v1.17.8 / v1.18.4 中发布 一览 字段| 详情 ---|--- 漏洞类型| BOLA / IDOR（对象级授权失效） 目标| osTicket v1.18-git - 提交 2570d69 组件|...

CVE-2021-2471

CVE-2021-2471 - MySQL Connector/J 中的 XXE 漏洞 Oracle MySQL 的 MySQL 连接器产品（组件：Connector/J）存在漏洞。受影响的受支持版本是 8.0.26 及更早版本。 成功利用此漏洞可导致对关键数据的未授权访问，或完全访问所有 MySQL 连接器可访问的数据，并能够未经授权地导致 MySQL 连接器挂起或频繁可重复的崩溃（完全拒绝服务）。 免责声明： 此漏洞由阿里云安全团队的徐远珍和阿里巴巴的陈宏坤发现。 本 PoC 仅供研究目的使用。请勿将其用于攻击未获得明确授权的目标。 供应商披露：...

CVE-2019-6340

CVE-2019-6340 CVE-2019-6340 POC Drupal RCE python poc.py url php func command node number 示例： python poc.py http://192.168.142.148/drupal-8.6.9/ system ipconfig 200 Twitter: @0w4ys...

MSRKit

MSRKit 一个通过易受攻击的驱动程序（AmdTools64.sys）中的 wrmsr 原语，利用 ROP 链来调用 内核函数和映射 驱动程序的工具。 工作原理 1. 通过 NtLoadDriver 加载 AmdTools64.sys（如果符号链接不可用，则回退到 PnP 设备节点 + 基于 GUID 的设备接口） 2. 通过驱动程序的 MSR 读取 IOCTL（0xFFF02804）读取 IA32LSTAR 3. 在 ntoskrnl.exe 中扫描 ROP gadget（pop rcx; ret、mov cr4, rcx; ret、wbinvd; ret 等） 4. 用入口...

CVE-2024-33113

CVE-2024-33113 El router D-LINK DIR-845L es vulnerable a una divulgación de información a través del archivo bscsmsinbox.php. La CVE-2024-33113 es una vulnerabilidad en el router D-LINK DIR-845L que permite una divulgación de información mediante el archivo bscsmsinbox.php. La vulnerabilidad se...

CVE-2025-7340

🚨 HT Contact Form Widget 以执行系统命令。 ✅ 示例： http://target.com/wp-content/uploads/htform/temp/shell.php?cmd=whoami 🖥️ 示例输出 Starting exploit against target... Fetching target page... Extracting parameters... Extracted Nonce: 346c4...

CVE-2024-7627-PoC

CVE-2024-7627-PoC 背景 このProof-of-Concept（PoC）スクリプトは、WordPressプラグインBit File Managerバージョン6.0～6.5.5における、競合状態を利用した認証なしリモートコード実行の脆弱性（CVE-2024-7627）に対するものです。 情報 説明： WordPress用プラグインBit File...

DrayTek-Exploit

CVE-2022-23093 FreeBSD Desbordamiento Basado en Pila Información ⚠️ El shellcode que se usa por defecto es FreeBSD/x86-64 - execve - 28 bytes de Gitsnik , cámbialo y pon el tuyo propio para empezar ⚠️ Detalles de la Vulnerabilidad La utilidad ping, utilizada para solicitar un ICMP ECHORESPONSE de...

CallStranger

CallStranger 此脚本由 Yunus Çadırcı（https://twitter.com/yunuscadirci）创建，用于检测 CallStranger（CVE-2020-12695）漏洞。攻击者可利用此漏洞进行： 绕过 DLP 以窃取数据 利用数百万面向互联网的 UPnP 设备作为放大反射式 TCP DDoS / SYN Flood 的源 从面向互联网的 UPnP 设备扫描内部端口 该脚本仅模拟数据窃取。 详细信息请访问 https://www.callstranger.com https://kb.cert.org/vuls/id/339275...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: jfs: Fixed the uninit-value access to imap allocated in the diMount function. The syzbot reports that hexdumptobuffer uses uninit-value: ===================================================== BUG: KMSAN: uninit-value in...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ice: Check the VF VSI Pointer Value in icevcaddfdirfltr. As mentioned in the commit baeb705fd6a7 “ice: Always check the VF VSI Pointer Values”, we need to perform a null pointer check on the return value of icegetvfvsi before usi...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: drm/amd/display: Fixed a potential index out of bounds issue in the color transformation function. The issue could occur when the index ‘i’ exceeds the number of transfer function points TRANSFERFUNCPOINTS. The fix includes a...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: usb: gadget: ffs: The function ffsdataclear is called twice. This call occurs when ffsfskillsb and ffsep0release are executed. As a result, the function ffsdataclear is called twice when the userland process closes ep0 and...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: mmc: uniphier-sd: A resource leak has been fixed in the remove function. A call to tmiommchostfree is missing from the remove function, in order to balance a call to tmiommchostalloc in the probe. This is done in the error handli...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel before version 5.16.3, the driver/bluetooth/hciqca.c file misinterprets the return value of devmgpiodgetindexoptional. It expects the return value to be NULL in the error case, but in reality, it is an error pointer...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: The TOCTOU issue in skisreadable has been fixed. sk-skprot-sockisreadable is a valid function pointer when sk resides in a sockmap. After the last skpsockput call which usually occurs when a socket is removed from the sockma...