6621 matches found
badblood
Bad Blood Bad Blood es un exploit para CVE-2021-20038, un desbordamiento de búfer basado en pila en el binario httpd de los sistemas de la serie SMA-100 que utilizan versiones de firmware 10.2.1.x. He escrito muchos de los detalles técnicos aquí: AttackerKB CVE-2021-20038 El exploit, tal como est...
Binary-Exploitation-and-Kernel-Escalation
Binary-Exploitation-and-Kernel-Escalation Acceso a nivel root asegurado mediante la identificación y explotación de configuraciones incorrectas y software desactualizado. Vulnerabilidad de desbordamiento de búfer en una versión desactualizada de modssl CVE-2002-0082. La escalada de privilegios se...
CVE-2025-53020-PoC
CVE-2025-53020 - PoC de Agotamiento de Memoria HTTP/2 Apache httpd Una prueba de concepto que demuestra CVE-2025-53020, una vulnerabilidad de agotamiento de memoria en la implementación HTTP/2 de Apache httpd que encontré a mediados de 2025. 📖 Análisis profundo :...
CVE-2021-41773-Playground
CVE-2021-41773 实验环境 一些用于演练 CVE-2021-41773 和 CVE-2021-42013 的 Docker 镜像 运行 docker compose up -d 启动所有容器。 服务器将运行在 8080、8081、8082 和 8083 端口上。 8080 包含一个禁用了 CGI 的 Apache 2.4.49。 8081 包含一个启用了 CGI 的 Apache 2.4.49。 8082 包含一个禁用了 CGI 的 Apache 2.4.50。 8083 包含一个启用了 CGI 的 Apache 2.4.50。 每个服务器上都有一些标志，位于...
CVE-2018-12633-TPLink-Auth-Bypass
CVE-2018-12633-TPLink-Auth-Bypass Un estudio de caso técnico y análisis de explotación de la vulnerabilidad de omisión de autenticación en el firmware TP-Link TL-WR840N CVE-2018-12633. Análisis de Vulnerabilidad: TP-Link TL-WR840N Authentication Bypass CVE-2018-12633 ⚠️ Descargo de responsabilidad...
CVE-2026-88831
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...
UBUNTU-CVE-2026-88831
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...
DEBIAN-CVE-2026-88837
BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...
DEBIAN-CVE-2026-88831
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...
CVE-2026-88837
BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...
CVE-2026-88831
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...
CVE-2026-88837
The BusyBox httpd component is vulnerable to an authentication bypass because it incorrectly treats yescrypt ($y$) password hashes as plaintext during Basic Authentication . This flaw inverts the authentication check, potentially allowing unauthorized access. To mitigate this risk, users are advi...
CVE-2026-88837 Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication
BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...
CVE-2026-88837 Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication
BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...
CVE-2026-88831 Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...
EUVD-2026-85509
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...
CVE-2026-88837
BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check. Mitigation Do not use BusyBox httpd for password-protected resources. If it must be used, configure authentication with SHA-512 $6$ hashes, which are correctly detected...
CVE-2026-88831 Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...
CVE-2026-88831
The BusyBox httpd component is vulnerable to a security bypass where IP deny rules with invalid CIDR prefix lengths fail open. The system leaves a parsed IP with a zeroed mask, causing the rule to match no clients and allowing potentially unauthorized access. To mitigate this, users should audit ...
