LamaHub 0.0.6.2 - Remote Buffer Overflow

Exploit Title: LamaHub-0.0.6.2 BufferOverflow Date: 09/09/09 Exploit Author: Pi3rrot Vendor Homepage: http://lamahub.sourceforge.net/ Software Link: http://ovh.dl.sourceforge.net/sourceforge/lamahub/LamaHub-0.0.6.2.tar.gz Version: 0.0.6.2 Tested on: Debian 8 32bits This exploit may crash the...

(size_t)BIO_write(in, buf, len) == len

Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=6308967940620288 Fuzzer: libFuzzer Job Type: libfuzzerasanopenssl Platform Id: linux Crash Type: ASSERT Crash Address: Crash State: sizetBIOwritein, buf, len == len fuzzer::Fuzzer::ExecuteCallback fuzzer::Fuzzer::RunOne...

Heap-buffer-overflow in xmlDictComputeFastKey

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5408788102250496 Fuzzer: libFuzzerlibxml2readmemoryfuzzer Job Type: libfuzzerasanlibxml2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

Evolutionary Knowledge Based Fuzzer: Choronzon

Evolutionary Knowledge Based Fuzzer Choronzon is an evolutionary fuzzer. It tries to imitate the evolutionary process in order to keep producing better results. To achieve this, it has an evaluation system to classify which of the fuzzed files are interesting and which should be dropped. Moreover...

General Purpose Fuzzer: Radamsa

Radamsa is a test case generator for robustness testing, a.k.a. a fuzzer. It is typically used to test how well a program can withstand malformed and potentially malicious inputs. It works by reading sample files of valid data and generating interestringly different outputs from them. The main...

American Fuzzy Lop Utilities: afl-utils

Utilities for automated crash sample processing/analysis, easy afl-fuzz job management and corpus optimization afl-utils is a collection of utilities to assist fuzzing with american-fuzzy-lop afl . afl-utils includes tools for: automated crash sample collection, verification, reduction and analys...

Black-Box CAN Network Analysis Framework: CANToolz

CANToolz is a framework forCANbus network and device analysis. This tool consist of various different modules which can be piped together and used by security researchers and automotive/OEM security testers for black-box analysis of any CANbus system. You can use this software for ECU discovery,...

SFTPfuzzer - Simple FTP Fuzzer

SFTPfuzzer Simple FTP Fuzzer is a very simple software written in Python 2.7 by 0x8b30cc, that allows you to easily fuzz username and password field in an FTP Server , looking for a buffer overflow vulnerability. SFTPfuzzer is written in a very simple way, and the code is well commented, allowing...

CVE-2016-2549

sound/core/hrtimer.c in the Linux kernel before 4.4.1 does not prevent recursive callback access, which allows local users to cause a denial of service deadlock via a crafted ioctl call...

Python Fuzzing Framework: Kitty

Kitty is an open-source modular and extensible fuzzing framework written in python, inspired by OpenRCE’s Sulley and Michael Eddington’s and now Deja Vu Security’s Peach Fuzzer . Goal The goal of Kitty was to help with fuzzing unusual targets — proprietary and esoteric protocols over non-TCP/IP...

Network Protocol Fuzzing: boofuzz

Boofuzz is a fork of and the successor to the Sulley fuzzing framework. Besides numerous bug fixes, boofuzz aims for extensibility, with the eventual goal of being able to fuzz literally anything. Sulley has been the preeminent open source fuzzer for some time, but has fallen out of maintenance...

Linux System Call Fuzzer: Trinity

System call fuzzers aren’t a particularly new idea. As far back as 1991, people have written apps that bomb syscall inputs with garbage data, that have had a variety of success in crashing assorted operating systems. After fixing the obvious dumb bugs however, a majority of the time these calls...

SSL and TLS protocol test suite and fuzzer: tlsfuzzer

tlsfuzzer is a combination of TLS test framework, ready-to-use tests and hopefully in the future a fuzzer for TLS protocol. The aim is to have ability to test TLS implementation everywhere a fairly recent version of Python can run 2.6, 3.2 or later. Current implementation efforts focus on testing...

Mail.ru: [allods.my.com] Full SQL Disclosure

Уязвимость имеет ту же природу, что и в 96729 и в 96727. Уязвимость возникает вследствие чтения ошибок через включенный Debug-режим. И там, и там - раскрытие информации за счёт debug-режима. Но для того, что бы раскрыть SQL запрос необходимо произвести Stress-тест многочисленными запросами любой...

DLA-330-1 unzip - security update

Bulletin has no description...

FreeBSD : mbedTLS/PolarSSL -- multiple vulnerabilities (5d280761-6bcf-11e5-9909-002590263bf5)

ARM Limited reports : Florian Weimar from Red Hat published on Lenstra's RSA-CRT attach for PKCS1 v1.5 signatures. These releases include countermeasures against that attack. Fabian Foerg of Gotham Digital Science found a possible client-side NULL pointer dereference, using the AFL Fuzzer. This...

Security Oriented Fuzzer: American Fuzzy Lop

American fuzzy lop is a security-oriented fuzzer that employs a novel type of compile-time instrumentation and genetic algorithms to automatically discover clean, interesting test cases that trigger new internal states in the targeted binary. This substantially improves the functional coverage fo...

Dharma - A generation-based, context-free grammar fuzzer

A generation-based, context-free grammar fuzzer. Requirements None Examples Generate a single test-case. % ./dharma.py -grammars grammars/webcrypto.dg Generate a single test case with multiple grammars. % ./dharma.py -grammars grammars/canvas2d.dg grammars/mediarecorder.dg Generating test-cases a...

Multi Purpose Fuzzer: zzuf

Multi Purpose Fuzzer zzuf is a transparent application input fuzzer. Its purpose is to find bugs in applications by corrupting their user-contributed data which more than often comes from untrusted sources on the Internet. It works by intercepting file and network operations and changing random...

Palo Alto Traps Server 3.1.2.1546 - Persistent Cross-Site Scripting

!/usr/bin/ruby =begin ------------------------------------------------------------------------ Product: Palo Alto Traps Server formerly Cyvera Endpoint Protection Vendor: Palo Alto Networks Vulnerable Versions: 3.1.2.1546 Tested Version: 3.1.2.1546 Advisory Publication: 29 March 2015 Vendor...