CVE-2026-24061

CVE-2026-24061 Telnet RCE エクスプロイト - SafeBreach Labs 作 このスクリプトは、不正な USER 環境変数を使用して Telnet サーバー内の CVE-2026-24061 の脆弱性を悪用します。 使用方法 ターゲットホストを指定してスクリプトを実行します: root@kitploit: python telnetrce.py -p 引数 host: ターゲットの IP アドレスまたはホスト名 必須 -p, --port: ターゲットのポート デフォルト: 23 例 root@kitploit: python telnetrce.py...

CVE-2017-3881-exploit-cisco-

Cisco Cluster Management ProtocolCMP 처리 코드의 Cisco IOS 및 Cisco IOS XE 소프트웨어 취약점으로 인해 인증되지 않은 원격 공격자가 영향을 받는 장치를 재부팅하거나 상승된 권한으로 원격 코드를 실행할 수 있습니다. 클러스터 관리 프로토콜은 클러스터 구성원 간의 신호 및 명령 프로토콜로 Telnet을 내부적으로 사용합니다. 이 취약점은 두 가지 요소의 조합으로 인해 발생합니다. 1 CMP 관련 Telnet 옵션 사용을 클러스터 구성원 간의 내부 로컬 통신으로만 제한하지 않고 영향을 ...

CVE-2026-89701

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate nseconds in TIMEDELEG decode paths The xdrgen-based TIMEDELEGACCESS and TIMEDELEGMODIFY decode arms store a raw uint32t nseconds directly into tvnsec without enforcing nseconds NSECPERSEC. The legacy...

CVE-2026-89606

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject too-small tag 70 packets ecryptfsparsetag70packet subtracts fixed metadata fields from the parsed packet body size to derive the encrypted filename size. A malformed packet with a body smaller than those fixed...

PoC-CVE-2025-69421

CVE-2025-69421 충돌 전용 재현기 이 저장소는 격리된 실험실 환경에서 CVE-2025-69421을 재현하는 최소한의 잘못된 형식의 PKCS12 파일을 포함합니다. 생성된 PFX에는 선택적 encryptedContent 필드가 생략된 EncryptedData의 EncryptedContentInfo가 포함됩니다. 취약한 OpenSSL 버전은 PKCS12unpackp7encdata에서 NULL ASN1OCTETSTRING 포인터를 PKCS12itemdecryptd2iex로 전달할 수 있으며, 이 함수는 NULL 검사 없이...

CVE-2026-49837

GoBGP is an open source Border Gateway Protocol BGP implementation in the Go Programming Language. Versions prior to 4.6.0 contain a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded b...

CVE-2025-60751

CVE-2025-60751: GeographicLib 基于栈的缓冲区溢出 📌 本仓库包含漏洞 CVE-2025-60751 的分析和技术文档，这是一个位于 C++ 库 GeographicLib 中的基于栈的缓冲区溢出 漏洞。 📝 描述 该漏洞存在于 GeoConvert 组件中的 DMS::InternalDecode 函数内。 当库尝试处理格式错误或过长的 DMS （度、分、秒）坐标字符串时，会导致超出栈上分配缓冲区边界的写入 。 标识符 ：CVE-2025-60751 组件 ：GeoConvert / DMS::InternalDecode 类型 ：基于栈的缓冲区溢出...

CVE-2023-40294-and-CVE-2023-40295

제 환경에서 boron을 실행하던 중, 우연히 2개의 힙 버퍼 오버플로우를 발견했습니다. libboronlibboron.so.2 버전 2.0.8에서 약간 잘못된 형식의 입력을 처리할 때 발생했습니다. 이는 Mac x8664과 Linux x8664에서 공식적으로 테스트되었습니다: Files for reproduction reproduction.zip 컴파일 git clone https://github.com/0branch/boron.git cd boron ./configure && make sudo make install &&...

xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

Summary xmldom's parser silently accepts a not-well-formed end tag whose valid name is followed by trailing content — e.g. . The element is closed, the trailing content is discarded, and no error is reported, even though the XML end-tag production allows only optional whitespace after the name an...

xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge

Summary xmldom's malformed-input error-recovery path has two quadratic-time On² behaviors that a single crafted input triggers together, so a tiny, highly compressible document tens of KB stalls the Node.js event loop for multiple seconds. It is reachable from DOMParser.parseFromString under...

CVE-2026-86287 Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths

Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table. The result is that the lookup will silently succe...

CVE_2019_19844

djangocve201919844poc CVE-2019-19844에 대한 PoC 설정 1. docker-compose run --service-ports web python manage.py migrate --no-input 2. docker-compose run --service-ports web python manage.py createsuperuser [email protected] --username 0xsha 3. localhost:8000/accounts/password-reset로 이동하세요...

Colord: Slow rejection of oversized malformed color strings

...

CVE-2026-85730 smol-toml: Denial of Service via malformed TOML documents

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil calls indexOfNewline, receives -1 at the end of input, and...

CVE-2026-85730 smol-toml: Denial of Service via malformed TOML documents

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil calls indexOfNewline, receives -1 at the end of input, and...

CVE-2026-85730

smol-toml , a lightweight TOML parser and serializer for JavaScript/TypeScript, is vulnerable to a Denial of Service via malformed TOML documents prior to version 1.7.1 . The root cause lies in src/util.ts, where skipUntil() calls indexOfNewline() and receives -1 at end-of-input, causing the curs...

CVE-2026-85730 smol-toml: Denial of Service via malformed TOML documents

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil calls indexOfNewline, receives -1 at the end of input, and...

CVE-2026-85504

FreeIPMI before 1.6.19 has a stack-based buffer overflow in ipmiseloemfujitsugetselentrylongtext in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses...

CVE-2026-85504

FreeIPMI before 1.6.19 has a stack-based buffer overflow in ipmiseloemfujitsugetselentrylongtext in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses...

CVE-2026-80747

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized...