CVE-2026-81014

CVE-2026-81014 is a heap out-of-bounds read in the Linux kernel's platform/x86: hp-bioscfg driver, affecting the sk_store() and kek_store() sysfs write handlers. Both functions strip a trailing newline from user input and allocate a key buffer of size length (one byte shorter), but then pass the ...

CVE-2026-81014 platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read in skstore and kekstore skstore and kekstore strip a trailing newline from the sysfs write before allocating the key buffer: length = count; if buflength - 1 == '\n' length--;...

EUVD-2026-76337

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read in skstore and kekstore skstore and kekstore strip a trailing newline from the sysfs write before allocating the key buffer: length = count; if buflength - 1 == '\n' length--;...

EUVD-2026-76336

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validatepasswordinput computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first. Writi...

CVE-2026-81013

CVE-2026-81013 is a heap out-of-bounds read in the Linux kernel's hp-bioscfg platform driver. The root cause is in validate_password_input(), which computes length = strlen(buf) and then checks buf[length - 1] to strip a trailing newline without first verifying that length is nonzero. Writing a b...

CVE-2026-81013 platform/x86: hp-bioscfg: fix heap OOB read on empty password write

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validatepasswordinput computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first. Writi...

CVE-2026-81011 platform/x86: hp-bioscfg: pass validated element count to package parsers

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: pass validated element count to package parsers The per-type package parsers are handed the wrong element count. hpinitbiospackageattribute validates obj-package.count and then calls one of the five...

CVE-2026-80960 dm-pcache: validate on-media seg_num against the cache device size

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate on-media segnum against the cache device size segnum is read from the crc32c-only superblock, so whoever supplies the cache device on a table load CAPSYSADMIN controls it. It sizes cache-segments and is the...

EUVD-2026-76283

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate on-media segnum against the cache device size segnum is read from the crc32c-only superblock, so whoever supplies the cache device on a table load CAPSYSADMIN controls it. It sizes cache-segments and is the...

CVE-2026-80960

CVE-2026-80960 is an out-of-bounds write vulnerability in the Linux kernel's dm-pcache (device-mapper persistent cache) module. The on-media seg_num field, read from a crc32c-only superblock, is attacker-controlled by anyone with CAP_SYS_ADMIN who supplies the cache device at table load. It is ne...

BugId

BugId Detecta, analiza e identifica de forma única los errores de las aplicaciones. TL;DR ¿Quieres... saber qué tipo de error está causando que una aplicación se bloquee? saber si un error podría ser una vulnerabilidad de seguridad? averiguar si dos o más bloqueos son causados por el mismo error?...

CVE-2023-4911

CVE-2023-4911 - Looney Tunables 这是一个（目前还非常粗糙的）CVE-2023-4911概念验证。到目前为止，我只验证了它在 Ubuntu 22.10 kinetic 上可以工作。当前版本的漏洞利用包含相当多的“魔法”偏移量。如果你对如何改进堆布局有建议， 欢迎向我的仓库提交 PR :。 该漏洞利用基本上是 Qualys 的优秀分析文章 的实现。在某些地方有所偏离。 这不一定是因为我认为自己更懂，只是在我的虚拟机上这样做是可行的。可能还有改进的空间。 使用方法 1. 使用 make 编译漏洞利用程序和 suid 库。 2. 从包含 suidlib.so 和...

rop-tool

rop-tool v2.4.2 一个帮助你编写二进制漏洞利用的工具 选项 root@kitploit: rop-tool v2.4.2 Help you make binary exploits. Usage: rop-tool OPTIONS Commands : gadget Search gadgets patch Patch the binary info Print info about binary heap Display heap structure disassemble Disassemble the binary search Search on binary he...

vpwn

vpwn por qwertyoruiop explotación genérica de desbordamiento de heap en xnu. salida de demostración: $ ./pwn i Preparing payload... i broke out of kaslr, kaslrslide = 0000000001a00000 + Payload successfully crafted. i Manipulating the heap... i Exploit loaded. + got r00t sh-3.2 uname -a Darwin...

Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-3156

Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-3156 Version Vulnarable To The Exploit The Baron Samedit vulnerability CVE-2021-3156 affects sudo legacy versions 1.8.2 through 1.8.31p2 and stable versions 1.9.0 through 1.9.5p1. This heap-based buffer overflow flaw was introduced in July 2011 via comm...

CVE-2023-38545-libcurl-SOCKS5-heap-buffer-overflow

免责声明 本文仅用于技术讨论与学习，利用此文所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责，文章作者不为此承担任何责任。 CVE-2023-38545：libcurl-SOCKS5-heap-buffer-overflow 参考项目：https://github.com/UTsweetyfish/CVE-2023-38545 做一次复现 复现流程： 1. 运行如下指令开一个socks5服务，监听端口10801： root@kitploit: ssh -D 10801 127.0.0.1 1...

python-haystack

python-haystack 内存取证 |travis| |coverage| |landscape| |pypi| |docs| 快速开始 docs/ 文件夹中的 快速使用指南 。 docs/ 文件夹中的 Haystack-reverse CLI 。 更多文档 介绍 python-haystack 是一个堆分析框架，专注于搜索和逆向已分配内存中的 C 结构体。 第一个功能/API 是 SEARCH 函数。 它可以在进程内存转储或活动进程内存中搜索已知的记录类型。 第二个功能/API 是扩展 python-haystack-reverse 中的 REVERSE 函数。...

CVE-2023-27997-check

CVE-2023-27997 漏洞评估工具 基于响应时序安全检测 FortiGate SSL VPN 实例是否存在 CVE-2023-27997 漏洞。查看 Bishop Fox 博客上的完整文章，其中包含本工具背后方法的完整讲解。 描述 CVE-2023-27997 是 FortiGate SSL VPN 组件中的一个基于堆的缓冲区溢出漏洞，已被证明可用于触发预认证 RCE。由于这是一个内存损坏错误，我们需要能够在不用崩溃 sslvpnd 进程且不断开活动用户连接的情况下检测到存在漏洞的版本。 该工具将向存在漏洞的 URL 路径发送 800...

Apple-Remote-Crash-Tool-CVE-2018-4407

Apple-Remote-Crash-Tool-CVE-2018-4407 Bloquea cualquier dispositivo macOS High Sierra o iOS 11 que esté en la misma red WiFi Solo una pequeña herramienta que utiliza una vulnerabilidad pública de 'desbordamiento de búfer en el montón' CVE-2018-4407 y facilita la explotación de redes completas...

EUVD-2026-76166

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit...