-CVE-2024-39614

Django 서비스 거부 취약점 PoC Proof of Concept 이 저장소는 Django 5.05.0.7 미만 및 4.24.2.14 미만 버전의 서비스 거부DoS 취약점을 시연하는 PoC 스크립트를 포함합니다. 취약점은 getsupportedlanguagevariant 함수에 있으며, 특정 문자를 포함한 매우 긴 문자열을 처리할 때 잠재적인 DoS 공격에 취약합니다. 목차 취약점 설명 설정 및 사용법 PoC 스크립트 중요 고려사항 완화 방법 취약점 설명 CVE-ID : 보류 중 개요 : Django 5.05.0.7 미만 ...

CVE-2025-46819

CVE-2025-46819 – Redis Lua 長文字列デリミタの範囲外読み取り 不正な長文字列デリミタにより、Redis 8.2.1 の Lua レキサーで範囲外読み取り（OOB read）が発生します。 概要 Redis 8.2.1 の Lua 長文字列パーサーは、不正な =... シーケンスを誤って処理し、バッファアンダーフローや過剰な再帰を引き起こすセンチネル値を返します。攻撃者はこれにより、Redis に範囲外読み取りを発生させたり、C スタックをオーバーフローさせたりすることができます。 環境 Redis サーバー 8.2.1（または 8.2.2...

CVE-2019-11395

CVE-2019-11395 개요 이 PoCProof of Concept는 MailCarrier 2.51의 버퍼 오버플로 취약점 을 보여주며, 원격 공격자가 긴 문자열을 통해 임의 코드를 실행할 수 있도록 합니다. 이 취약점은 다음 프로세스를 이용하여 악용될 수 있습니다: SMTP RCPT TO POP3 USER POP3 LIST POP3 TOP POP3 RETR 이 프로젝트는 버퍼 오버플로가 어떻게 작동하는지 이해하는 데 학술적 접근 방식 을 제공하는 것을 목표로 합니다. ⚠️ 경고 테스트를 실행하기 전에 초기 실험에 절대...

Astra Linux – Vulnerability in uriparser

A issue was discovered in uriparser through 0.9.7. The ComposeQueryMallocExMm function in UriQuery.c has an integer overflow due to the use of a long string...

PT-2026-80529

Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS regular expression Denial of Service via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1...

Oj: Integer Overflow in Oj.load 2GB String Handling

Summary Oj.load is vulnerable to heap corruption when parsing a JSON string longer than 2 GB. An integer overflow in bufappendstring buf.h:61 converts the string length to a large negative sizet, causing memcpy to copy an astronomically large amount of data out of bounds. This crashes the process...

CVE-2021-47973

Sticky Notes Widget 3.0.6 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long character strings into note fields. Attackers can generate a payload containing 350000 repeated characters and paste it twice into a new note to trigger ...

CVE-2021-47973 Sticky Notes Widget 3.0.6 Denial of Service via Buffer Overflow

Sticky Notes Widget 3.0.6 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long character strings into note fields. Attackers can generate a payload containing 350000 repeated characters and paste it twice into a new note to trigger ...

CVE-2021-47971

My Notes Safe 5.3 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long character strings into note fields. Attackers can generate a payload containing 350000 repeated characters and paste it twice into a new note to trigger an...

CVE-2026-7568

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, the metaphone function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed...

CVE-2026-41693

i18next-fs-backend is a backend layer for i18next using in Node.js and for Deno to load translations from the filesystem. Prior to version 2.6.4, i18next-fs-backend substitutes the lng and ns options directly into the configured loadPath / addPath templates and then read / write the resulting fil...

ruby: Unsafe parsing of long strings via decode_www_form_component method

The URI.decodewwwformcomponent method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial of service catastrophic regular expression backtracking, resource consumption, or application crash via a crafted string...

PT-2026-30466

AnyBurn 4.3 x86 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string to the image conversion function. Attackers can paste a large buffer into the source or destination image file fields and click Convert Now to...

EUVD-2018-21732

Microsoft VSCO 1.1.1.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string through the search functionality. Attackers can paste a buffer of 5000 characters into the search bar and navigate back to trigger an...

EUVD-2018-21742

Microsoft Eco Search 1.0.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string to the search functionality. Attackers can paste a buffer of 950 or more characters into the search bar and trigger a crash by...

CVE-2018-25244: Missing Protection for Mirrored Regions in On-Chip Fabric Firewall

Eco Search 1.0.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string to the search functionality. Attackers can paste a buffer of 950 or more characters into the search bar and trigger a crash by initiating a...

CVE-2018-25240: Improper Handling of Overlap Between Protected Memory Ranges

Watchr 1.1.0.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string to the search functionality. Attackers can paste a buffer of 8145 characters into the search bar and trigger a search operation to cause the...

Eco Search 安全漏洞

Eco Search is a search tool developed by the Eco Search company. Version 1.0.2.0 of Eco Search contains a security vulnerability. This vulnerability arises from the search function’s improper handling of extremely long strings, which may allow local attackers to cause the application to crash by...

PT-2026-30364

Name of the Vulnerable Software and Affected Versions FastTube version 1.0.1.0 Description A denial of service issue exists that allows local attackers to crash the application. This occurs when an excessively long string, specifically a buffer of 1900 characters, is submitted to the search...

EUVD-2018-21719

Free IP Switcher 3.1 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Computer Name field. Attackers can paste a malicious payload into the Computer Name input field and click Activate to trigger a denial ...