CVE-2016-3308

利用 CVE-2016-3308 破坏 win32k 桌面堆 作者：@55-AA，2016年9月18日 介绍 桌面堆是一个由 win32k 使用的内核池，可以被用户态应用程序利用。这里我将详细描述如何实现一个可靠的利用，从而在内核中读写任意地址。本文及相关的分析基于 win7sp1x86（build 17842）环境。 漏洞 2016年8月9日，微软发布了 MS16-098。漏洞代码位于函数 win32k!xxxInsertMenuItem 中，函数原型如下： root@kitploit: BOOL xxxInsertMenuItem PMENU pMenu, UINT wIndex,...

rosenbridge

project:rosenbridge : hardware backdoors in x86 CPUs github.com/xoreaxeaxeax/rosenbridge // domas // @xoreaxeaxeax Overview project:rosenbridge reveals a hardware backdoor in some desktop, laptop, and embedded x86 processors. The backdoor allows ring 3 userland code to circumvent processor...

CVE-2024-0070-NVIDIA-GPU-Driver--Resonance-Vulnerability

CVE-2024-0070-NVIDIA-GPU-Driver--Resonance-Vulnerability NVIDIA GPU 驱动程序在其内存管理中存在时间一致性缺陷。在 587 kHz 共振频率下，驱动程序的内存页出现 α 衰变干扰，从而允许从用户空间访问内核内存。 NVIDIA GPU α-共振利用 CVE-2024-0070 概述 此利用展示了 NVIDIA GPU 驱动程序中基于收敛时间理论（CTT）原理的时间一致性漏洞 。该漏洞源于 GPU 时钟频率是 587 kHz 的整数谐波 ，从而允许 α-共振绕过内存保护。 物理背景 NVIDIA GPU 时钟是...

Ring0VBA

Ring0VBA 使用 VBA 的 CVE-2018-6606 - https://disrel.com/posts/Ring0VBA-Getting-Ring0-Using-a-Goddamn-Word-Document/...

CVE-2020-14364

CVE-2020-14364 我的 ring0 利用...

CVE-2026-73417

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 3.3.0 until 4.5.10 and 4.6.2, JupyterLab allows notebook settings to be shared and applied through an overrides.json file using the Import button in the Settings...

Webkit-exploit

webkit with RCE only NO KERNEL YET, it's working on 9.00 for n...

CVE-2026-44180

Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. Versions 2.0.0rc1 and above prior to 3.3.0 have a prohibited UID and GID feature that by default prevents launching kernels with UID or GID 0 root, and...

OESA-2026-2868 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: arm64: io: Extract user memory type in ioremapprot The only caller of ioremapprot outside of the generic ioremap implementation is genericaccessphys, which passe...

Stored Cross-Site Scripting (XSS)

Jupyter Server is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to the nbconvert HTTP handlers rendering user-authored notebook HTML without a sandbox Content Security Policy CSP directive and the default non-sanitizing behavior of nbconvert.HTMLExporter, which allows an...

GHSA-FCW5-X6J4-CCMP Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP

The nbconvert HTTP handlers in jupyterserver render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a notebook carrying an HTML payload in a displaydata outpu...

GHSA-55HG-8QXV-QJ4P PhoenixStorybook: Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground

Summary An unsafe HEEx template generation vulnerability allows any unauthenticated user to execute arbitrary code on the server. The phoenixstorybook playground accepts user-controlled attribute values over WebSocket and interpolates them unsanitized into a HEEx template that is subsequently...

EUVD-2026-29301

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination or read kernel memory...

Apple多款产品 安全漏洞

Apple iOS and other products are owned by the American company Apple. Apple iOS is an operating system developed for mobile devices. Apple macOS is a specialized operating system designed for Mac computers. Apple iPadOS is an operating system for iPad tablets. Several of Apple’s products have...

Apple多款产品 安全漏洞

Apple iOS, among others, are products of the American company Apple. Apple iOS is an operating system developed for mobile devices. Apple macOS is a specialized operating system designed for Mac computers. Apple iPadOS is an operating system for iPad tablets. Several of Apple’s products have...

GHSA-RCH3-82JR-F9W9 Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS

Impact A stored Cross-Site Scripting XSS vulnerability in Jupyter Notebook allows attackers to steal authentication tokens from users who open malicious notebook files and interact with elements that the attacker can make look indistinguishable from legitimate controls single click interaction. T...

Exploit for CVE-2025-8061

CVE-2025-8061 is a privilege escalation vulnerability in Lenovo'...

CVE-2026-40317 NovumOS has Privilege Escalation in the Syscall Interface

NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 12 JumpToUser accepts an arbitrary entry point address from user-space registers without validation, allowing any Ring 3 user-mode process to jump to kernel addresses and execute...

CVE-2026-40317

NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 12 JumpToUser accepts an arbitrary entry point address from user-space registers without validation, allowing any Ring 3 user-mode process to jump to kernel addresses and execute...

PT-2026-33547

Name of the Vulnerable Software and Affected Versions NovumOS versions prior to 0.24 Description Syscall 12 'JumpToUser' accepts an arbitrary entry point address from user-space registers without validation. This allows a Ring 3 user-mode process to jump to kernel addresses and execute arbitrary...