cve-2025-5777-citrixbleed2_reproduction

CVE-2025-5777 — CitrixBleed 2 Citrix NetScaler 메모리 노출 CVSS 9.3 — 치명적 — 야생에서 활발한 악용 중 CitrixBleed 2는 Citrix NetScaler ADC 및 NetScaler Gateway의 메모리 노출 취약점입니다. 인증 엔드포인트의 불충분한 입력 검증으로 인해 메모리 초과 읽기CWE-125 가 발생하며, 인증되지 않은 공격자가 세션 쿠키, 암호화 자료 및 기타 비밀 정보를 포함한 민감한 메모리 내용을 유출할 수 있습니다. 개요 항목| 값 ---|--- CVE|...

CVE-2026-3055-Scanner---Herramienta-de-Detecci-n

🔍 CVE-2026-3055 スキャナー - NetScaler メモリ過剰読み取り検出ツール ⚠️ 警告 このツールは教育目的および許可されたテスト専用です。所有者の明示的な許可なくシステムで使用しないでください。 📋 説明 CVE-2026-3055 用の検出ツールで、memory overread に対して脆弱な Citrix NetScaler ADC および Gateway デバイスを識別します。単一ホスト、ネットワーク、またはホストリストによるスキャンを実行し、エンドポイント /wsfed/passive?wctx でのメモリリークを検出し、管理セッション ID...

CVE-2026-3055---Citrix-NetScaler-Memory-Overread-PoC

🔓 CVE-2026-3055 - Citrix NetScaler メモリ過剰読み取りエクスプロイト ⚠️ 警告 このツールは教育目的および許可されたテスト専用です。明示的な許可なくシステムで使用しないでください。 📋 説明 CVE-2026-3055 用エクスプロイト - SAML IDP として構成された NetScaler ADC および NetScaler Gateway におけるメモリ過剰読み取り（memory overread）の脆弱性。 🔍 CVSS スコア: 9.3 CRITICAL ベクター :...

CVE-2026-3055

CVE-2026-3055 - セキュリティ脆弱性 深刻度: N/A CVSS: N/A 影響: N/A 公開日: 2026-03-23 法的免責事項 許可されたセキュリティテストのみを対象としています。 根本原因（簡易版） SAML IDPとして構成されたNetScaler ADCおよびNetScaler Gatewayにおける入力検証の不備により、メモリの過剰読み取り（overread）が発生する 悪用の要件 到達可能な脆弱なターゲット 予測可能なユーザー/ワークフローコンテキスト 細工されたリクエストをブロックする追加のハードニングがないこと 使用方法 python3...

watchTowr-vs-Netscaler-CVE-2026-8451

CVE-2026-8451 Citrix Netscaler 메모리 초과 읽기 Citrix Netscaler overread 탐지 아티팩트 생성 도구! 작동 중 탐지 이 탐지 아티팩트 생성기는 대상 Netscaler 장치를 입력받아 CVE-2026-8451을 통해 메모리를 유출하려고 시도합니다. 필요한 것은 대상 시스템뿐입니다. 프로토콜을 포함하세요. 예: https://192.168.80.125. 메모리 일부를 유출하는 예시입니다: $ python3 watchTowr-vs-Netscaler-CVE-2026-8451.py...

netscaler-saml-memory-disclosure-security-assessment

CVE-2026-8451 - Citrix NetScaler SAML 메모리 오버리드CitrixBleed 컨설턴트 스타일 사이버 보안 보고서 NetScaler SAML 메모리 정보 노출 위험에 대한 전문 취약점 평가 보고서로, 기술적 영향, 수정 및 완화 전략을 포함합니다. 📍 보고서 개요 필드| 세부 정보 ---|--- 보고서 유형| 취약점 평가 보고서 업무 맥락| 보안 연구 주요 초점| 네트워크 엣지 보안 대상 독자| 보안 팀, 엔지니어링 팀, 채용 담당자 출력 스타일| 경영진 요약, 기술 분석, 비즈니스 영향, 수정 로드맵...

Linux Distros Unpatched Vulnerability : CVE-2026-93165

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - platform/chrome: sensorhub: Fix memory overread in ring handler maxresponse and sensornum are read from different EC commands: - maxresponse is from...

CVE-2026-93165

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Fix memory overread in ring handler maxresponse and sensornum are read from different EC commands: - maxresponse is from crosecgetprotoinfo. ecdev-maxresponse = info-maxresponsepacketsize - sizeofstruc...

DEBIAN-CVE-2026-93165

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Fix memory overread in ring handler maxresponse and sensornum are read from different EC commands: - maxresponse is from crosecgetprotoinfo. ecdev-maxresponse = info-maxresponsepacketsize - sizeofstruc...

CVE-2026-93165

A memory overread in the Linux kernel's Chrome sensorhub driver (platform/chrome/sensorhub) occurs when a malfunctioning EC firmware causes msg->insize to be clamped in cros_ec_cmd_xfer() because it exceeds max_response. The resulting shorter-than-expected read causes a subsequent memcpy() in ...

EUVD-2026-82273

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Fix memory overread in ring handler maxresponse and sensornum are read from different EC commands: - maxresponse is from crosecgetprotoinfo. ecdev-maxresponse = info-maxresponsepacketsize - sizeofstruc...

CVE-2026-93165 platform/chrome: sensorhub: Fix memory overread in ring handler

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Fix memory overread in ring handler maxresponse and sensornum are read from different EC commands: - maxresponse is from crosecgetprotoinfo. ecdev-maxresponse = info-maxresponsepacketsize - sizeofstruc...

CVE-2026-93165 platform/chrome: sensorhub: Fix memory overread in ring handler

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Fix memory overread in ring handler maxresponse and sensornum are read from different EC commands: - maxresponse is from crosecgetprotoinfo. ecdev-maxresponse = info-maxresponsepacketsize - sizeofstruc...

CVE-2026-93165: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Fix memory overread in ring handler maxresponse and sensornum are read from different EC commands: - maxresponse is from crosecgetprotoinfo. ecdev-maxresponse = info-maxresponsepacketsize - sizeofstruc...

Astra Linux – Vulnerability in Linux, Linux 5.10

A flaw was discovered in the Linux kernel’s driver for ASIX AX88179178A-based USB 2.0/3.0 Gigabit Ethernet devices. The vulnerability involves multiple out-of-bounds reads and possible out-of-bounds writes...

SUSE-SU-2026:2641-1 Security update for apache2

This update for apache2 fixes the following issues Update to 2.4.66 jscPED-16334: Security issues: - CVE-2026-23918: http2: double free and possible RCE on early reset bsc1263957. - CVE-2026-24072: modrewrite elevation of privileges via apexpr bsc1263935. - CVE-2026-28780: heap buffer overflow in...

CVE-2026-18794

OpenRGB is vulnerable in its network protocol due to insufficient input data validation. An attacker can pass inconsistent data over the network to cause memory exhaustion and out-of-bounds memory reads and writes , leading to denial-of-service and potential memory corruption. The vulnerability i...

CVE-2026-18794 OpenRGB: insufficient input data checks lead to Denial-of-Service, memory overread and overwrite

The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by passing inconsistent data...

CVE-2026-18794 OpenRGB: insufficient input data checks lead to Denial-of-Service, memory overread and overwrite

The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by passing inconsistent data...

CVE-2026-68366 usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: clamp SENDRESPONSE length to the response buffer uvcsendresponse builds the UVC control response from a user-supplied struct uvcrequestdata: req-length = mintunsigned int, uvc-eventlength, data-length;...