CVE-2025-14847

CVE-2025-14847 CVE-2025-14847 漏洞环境附带一份poc https://jira.mongodb.org/browse/SERVER-115508 SUMMARY This is a critical fix to address CVE-2025-14847. Upgrade to 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30. ISSUE DESCRIPTION AND IMPACT An client-side exploit of the Server's zlib implementation ca...

mongobleed-exploit-CVE-2025-14847

🩸 MongoBleed - CVE-2025-14847 安全研究实验室 CVE-2025-14847 | CVSS 8.7（高危）| 未认证内存泄露 📖 完整文档 • 🔬 技术分析 • ⚡ 快速命令 🎯 CVE-2025-14847 概述 MongoBleed 是 MongoDB 网络传输层中的一个严重内存泄露漏洞，允许未认证的远程攻击者 无需任何凭据或用户交互，即可窃取敏感的堆内存数据。 影响 类别| 描述 ---|--- 攻击类型| 远程未认证内存泄露 根本原因| zlib 解压返回分配的缓冲区大小，而非实际数据长度 泄露的数据| 数据库密码、API 密钥、会话令牌、AWS...

mongobleed-scanner

🐍 mongobleed-scanner - 轻松扫描MongoDB漏洞 🚀 快速开始 欢迎使用 mongobleed-scanner ！该工具帮助您发现与堆内存泄漏相关的MongoDB漏洞。轻松保护您的数据并增强安全性。 📥 下载应用 访问此页面下载最新版 mongobleed-scanner ：立即下载 💻 系统要求 下载前，请确保您的系统满足以下要求： 操作系统： Windows 10 或更高版本、macOS Mojave 或更高版本、或任何 Linux 发行版。 内存： 至少 2 GB RAM。 磁盘空间： 至少 200 MB 可用空间。 权限： 可能需要管理员权限才能正确安装。...

xpc-string-leak

xpc-string-leak xpc-string-leak 是 libxpc 中越界内存读取的概念验证漏洞利用程序。该漏洞利用利用该漏洞从 diagnosticd 中读取越界堆内存，diagnosticd 是一个未沙盒化的 root 进程，具有 taskforpid-allow 权限。 漏洞：CVE-2018-4248 在 macOS 10.13.5 和 iOS 11.4 上，函数 xpcstringdeserialize 在通过 xpcstringcreate 创建 XPC 字符串对象之前，没有验证反序列化的字符串是否具有正确的长度。如果随后将 XPC 字符串序列化到另一个 XPC...

CVE-2014-4140

一些粗略笔记 0:007 u MSHTML!CHtmRootParseCtx::AddText+0x104: 6efff0a5 8b8e88000000 mov ecx,dword ptr esi+88h 6efff0ab 898d70ffffff mov dword ptr ebp-90h,ecx 6efff0b1 8945ac mov dword ptr ebp-54h,eax 6efff0b4 8b5118 mov edx,dword ptr ecx+18h 6efff0b7 8bca mov ecx,edx 6efff0b9 83e103 and ecx,3 6efff0bc...

PHP_8.1.x_Exploit

🚀 PHP CVE Autopilot Detección y explotación automatizada de vulnerabilidades críticas de PHP bypass CVE-2024-4577, CVE-2025-14177, CVE-2025-14180, CVE-2025-14178 PHP8.1.xExploit.sh es una herramienta de evaluación de seguridad de un solo archivo, sin configuración que descubre automáticamente...

CVE-2026-88914

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read o...

DEBIAN-CVE-2026-88914

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read o...

PT-2026-89741

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read o...

CVE-2025-14857-MongoBleed

CVE-2025-14847 MongoBleed - 功能型 PoC MongoDB 内存泄露利用 - 模拟 R6 攻击 CVE-2025-14847 MongoBleed 的完整概念验证 已测试：✅ MongoDB 7.0.5 | 14.300+ 次成功利用 | 4 个 UUID 泄露 🎯 关于本项目 本仓库包含一个功能完整的概念验证（PoC） ，针对漏洞 CVE-2025-14847 ，也称为 MongoBleed ——MongoDB 中一个严重的预认证堆内存泄露缺陷。 背景：彩虹六号：围攻 事件 在 2025 年 12 月 ，游戏《彩虹六号：围攻》遭受了一次大规模攻击，约...

mongobleed

mongobleed CVE-2025-14847 是针对 MongoDB 通过 OPCOMPRESSED 缓冲区过度读取（buffer over-read）导致堆内存泄露的漏洞利用工具。 用法 root@kitploit: $ bundle exec ruby mongobleed.rb --help Usage: mongobleed.rb options --host HOST Target host default: localhost --port PORT Target port default: 27017 --min-offset MIN Min doc length...

CVE-2026-61908

A flaw was found in cyrus-imapd. An authenticated user could exploit this vulnerability by attempting to download a specially crafted JMAP JSON Meta Application Protocol blob ID. This action could lead to reading beyond the intended memory boundary, potentially exposing sensitive information from...

Linux Distros Unpatched Vulnerability : CVE-2026-61908

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of- bounds index. An authenticated user could attempt to...

CVE-2026-61908

An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H-, which could read past the end of the internal blobheaders array during download, exposing...

CVE-2025-14847

CVE-2025-14847 CVE-2025-14847 漏洞环境及 PoC https://jira.mongodb.org/browse/SERVER-115508 摘要 这是一个关键修复，用于解决 CVE-2025-14847。请升级至 8.2.3、8.0.17、7.0.28、6.0.27、5.0.32 或 4.4.30 版本。 问题描述与影响 攻击者可通过客户端利用服务器 zlib 实现的漏洞，在未进行身份认证的情况下返回未初始化的堆内存。我们强烈建议尽快升级至已修复版本。 此问题影响以下 MongoDB 版本： MongoDB 8.2.0 至 8.2.3 MongoDB...

CVE-2026-22590

eprosima Fast DDS is a C++ implementation of the DDS Data Distribution Service standard of the OMG Object Management Group. Versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 have a remotely triggerable Out-of-Bounds Read while processing RTPS DATAFRAG submessages. An attacker can craft a...

CVE-2026-22590 Fast-DDS Discovery Server: Out-of-Bounds Read & Heap Memory Disclosure via DATA_FRAG  sampleSize / fragmentsInSubmessage

eprosima Fast DDS is a C++ implementation of the DDS Data Distribution Service standard of the OMG Object Management Group. Versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 have a remotely triggerable Out-of-Bounds Read while processing RTPS DATAFRAG submessages. An attacker can craft a...

CVE-2026-22590

eProsima Fast DDS (a C++ implementation of the OMG DDS standard) has a remotely triggerable Out-of-Bounds Read in its RTPS DATA_FRAG submessage processing. An attacker can craft a DATA_FRAG with a large sampleSize but a small actual payload, and set fragmentsInSubmessage so the receiver takes the...

CVE-2026-22590 Fast-DDS Discovery Server: Out-of-Bounds Read & Heap Memory Disclosure via DATA_FRAG  sampleSize / fragmentsInSubmessage

eprosima Fast DDS is a C++ implementation of the DDS Data Distribution Service standard of the OMG Object Management Group. Versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 have a remotely triggerable Out-of-Bounds Read while processing RTPS DATAFRAG submessages. An attacker can craft a...

EUVD-2026-75058

eprosima Fast DDS is a C++ implementation of the DDS Data Distribution Service standard of the OMG Object Management Group. Versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 have a remotely triggerable Out-of-Bounds Read while processing RTPS DATAFRAG submessages. An attacker can craft a...