0day-security-software-vulnerability-analysis-technology

0day-security-software-vulnerability-analysis-technology 《0day安全：软件漏洞分析技术（第二版）》随书资料包使用注意事项 资料包中资料仅用于学习目的，任何组织、个人、机构不可以任何形式利用资料包中的资料进行商业盈利目的的活动。 资料包中的部分资料和实验代码有可能引起某些安全软件的报警，书籍作者，出版社，看雪论坛对这些使用这些资料造成的后果概不负责，请您在充分了解这些资料用途的基础上慎用。 任何组织、个人、机构不得利用本书及相关资料进行任何形式的非法活动。 root@kitploit: root@Jas502n:/tmp/0day...

MS17-010

MS17-010 本仓库用于公开我在 MS17-010 上的工作。我没有计划提供任何支持。所有支持问题都不会得到我的回应 。 文件 BUG.txt MS17-010 漏洞详情及部分分析 checker.py 用于查找可访问命名管道的脚本 eternalblueexploit7.py 针对 Windows 7/2008 的 Eternalblue 漏洞利用 eternalblueexploit8.py 针对 Windows 8/2012 x64 的 Eternalblue 漏洞利用 eternalbluepoc.py 针对缓冲区溢出漏洞的 Eternalblue PoC...

RLSA-2026:66348 Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator CVE-2026-28420 vim: Vim: Denial of Service via out-of-bounds write in terminal handling CVE-2026-52859 vi...

vim security update

An update is available for vim. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Vim Vi IMproved is an updated and improved version of the vi editor. Security...

CVE-2025-14321

CVE-2025-14321 概念验证 描述 针对 Firefox 中 RTCEncodedFrameBase 组件的释放后使用 UAF 漏洞的概念验证 PoC，该漏洞可通过 WebRTC 编码转换 API 利用。 CVE-2025-14321 : RTCEncodedFrameBase 的析构函数在释放帧的本机内存时未调用 DetachArrayBuffer。因此，JavaScript 的 ArrayBuffer 仍保留指向已释放内存的指针（悬挂指针），允许对 Firefox 内容进程堆进行任意读写。 此 PoC 已在 Mozilla Firefox 145.0.1 和 Windows...

nginx: NGINX: Arbitrary code execution via crafted HTTP requests

A flaw was found in NGINX. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests when the map directive uses regular expression regex matching and references regex capture variables before referencing the map output variable. This can lead to a heap...

nginx-cve-2026-42945-poc

CVE-2026-42945 — NGINX Rewrite Module 堆缓冲区溢出 → RCE RCE 已确认成功 — 通过堆溢出 + GDB 进程注入，在 NGINX / OpenResty worker 进程中执行任意命令。 快速开始 root@kitploit: 一键构建 NGINX 镜像 + 执行 RCE 测试 ./run.sh nginx 一键构建 OpenResty 镜像 + 执行 RCE 测试 ./run.sh openresty 自定义命令 ./run.sh nginx 'cat /etc/passwd' ./run.sh openresty 'whoami' 漏洞...

CVE-2026-42945

CVE-2026-42945 实际风险评估脚本 针对 CVE-2026-42945 （Nginx Rift）的本地风险评估工具。不同于直接告诉你"版本受影响就危险"，这个脚本会逐层检查真正决定风险的三个条件，给出符合你实际情况的结论。 背景 CVE-2026-42945 是 nginx ngxhttprewritemodule 中一个存在了 18 年的堆缓冲区溢出漏洞（CWE-122），CVSS 4.0 评分 9.2。但公告中有一句关键的限定： "Code execution possible on systems without ASLR protection" RCE...

openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()

A flaw was found in OpenSSL. When processing a specially crafted PKCS7 or S/MIME Secure/Multipurpose Internet Mail Extensions signed message, a heap use-after-free vulnerability in the PKCS7verify function can be triggered. This occurs if the SignedData digestAlgorithms field is present as an emp...

CVE-2026-11108-Integer-Overflow-in-Memory-Allocator-kmalloc-Sim-

CVE-2026-11108 – Desbordamiento de entero en asignador de memoria kmalloc Sim Código del programa C root@kitploit: // allocsim.c - Vulnerable memory allocator include include include define MAXBLOCK 1024 void mymallocsizet size sizet total = size + sizeofsizet; // header if total MAXBLOCK return...

CVE-2026-25243

CVE-2026-25243 — double-free doble liberación de Redis RESTORE → ejecución remota de código Verificado contra Rocky Linux 8.10, aarch64, Redis 8.6.2, jemalloc 5.3.0. Referencia: https://www.zeroday.cloud/blog/redis-cve-2026-25243-deep-dive TLDR; Exploit estable, funciona contra varias...

PHP_8.1.x_Exploit

🚀 PHP CVE 自动驾驶仪 自动检测和利用关键 PHP 漏洞 CVE-2024-4577 绕过, CVE-2025-14177, CVE-2025-14180, CVE-2025-14178 PHP8.1.xExploit.sh 是一个单文件、零配置 的安全评估工具，能够自动发现易受攻击的 PHP 端点，并利用影响 PHP 8.1.34 之前版本 （2024 年 12 月发布）的四个高危 CVE 。它无需手工构建载荷 ——只需提供一个 URL，脚本会自动完成从爬取到远程代码执行的全部工作。完全自动驾驶模式 ——无需用户提示即可自动检测和利用。 特性 完全自主的自动驾驶模式 – 给定一...

ps5-umtxdbg

NOTAS El bug fue encontrado a principios de diciembre de 2020, no por mí, sino por un genio que miró 15 minutos a fbsd e inmediatamente lo detectó 🙇‍♂️. Esta implementación en C++ se hizo al experimentar con el aumento de la fiabilidad del exploit después de que el kernel de ps5 añadiera algunas...

CVE-2026-88914

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read o...

DEBIAN-CVE-2026-88914

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read o...

CVE-2026-88914

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read o...

UBUNTU-CVE-2026-88914

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read o...

CVE-2021-3156

项目标题 CVE-2021-3156 sudo 漏洞利用生成器 安装 1. 安装依赖 ./install.sh 2. 运行漏洞利用生成器：./run.sh 3. 如果系统上的sudo版本存在漏洞，则会为已安装的版本生成漏洞利用代码 4. 漏洞利用代码生成在 exploit.c 和二进制文件 ./exploit 中 前提条件 1. gdb gcc make python3 python3-distro 2. 带 tcache 的 glibc 3. 当前支持 Ubuntu、Debian 操作系统 已测试环境 Ubuntu 20.04.1 Ubuntu 20.04.2 Ubuntu 20.10...

EUVD-2026-75905

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read o...

CVE-2026-88914

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read o...