knob

README Repositorio sobre los ataques de Negociación de Clave de Bluetooth KNOB en Bluetooth BR/EDR y Bluetooth Low Energy. Trabajo Relacionado Del estándar Bluetooth a los 0-days conformes al estándar HWIO20 Ataques de degradación de negociación de clave en Bluetooth y Bluetooth Low Energy TOPS20...

CVE-2026-11109-Bluetooth-Classic-KNOB-Attack-Key-Negotiation-of-Bluetooth-

CVE-2026-11109 – Ataque KNOB de Bluetooth Clásico Negociación de clave de Bluetooth Código del Programa Simulación en Python root@kitploit: knobattacksim.py - Simulates negotiation of encryption key size to 1 byte import random, hashlib class BluetoothDevice: def negotiatekeysizeself, proposedsiz...

Quantum-Silicon-Core-Loader

Quantum Silicon Core Loader Núcleo principal: qslcl.asm v0.0.2 en desarrollo Módulo asistente: qslcl.bin v0.7.4 Controlador universal: qslcl.py v2.2.2 Investigación legalmente protegida - Este proyecto opera bajo marcos legales establecidos para la investigación en seguridad, el derecho a reparar...

CVE-2026-24061

Laboratorio de Auto-Login Telnet con Docker Un laboratorio Docker ligero para experimentar con la negociación del protocolo Telnet , explicado en el exploit CVE-2026-24061, que contiene inyección automática de nombre de usuario mediante la opción NEW-ENVIRON. Este proyecto crea un entorno...

smbghost

Escáner SMBGhost CVE-2020-0796 Escáner de vulnerabilidad SMBv3 SMBGhost. Detecta hosts Windows vulnerables enviando un paquete de negociación SMBv3 malformado y verificando la respuesta. Uso root@kitploit: Host único python3 scanner.py -H 10.0.0.5 Lista de hosts python3 scanner.py -l targets.txt...

rapid-reset-check

Rapid Reset Check rapid-reset-check es un pequeño CLI en Go para inventariar rápidamente endpoints HTTPS que exponen HTTP/2 y, por lo tanto, necesitan una revisión de mitigación para CVE-2023-44487. El escáner es deliberadamente no explotativo. Resuelve cada objetivo, abre una conexión TLS...

CVE-2024-38475_SonicBoom_Apache_URL_Traversal_PoC

CVE-2024-38475SonicBoomApacheURLTraversalPoC Autor: abrewer251 Una herramienta de prueba de concepto para probar la vulnerabilidad de traversal de URL de Apache CVE-2024-38475 "SonicBoom". Este script automatiza la negociación TLS, el escaneo de directorios, la verificación de traversal y el...

GHSA-XWWF-M8FG-P9Q2 RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation

Summary A Denial of Service DoS vulnerability exists in the AMQP client's connection negotiation logic. The AMQP specification explicitly mandates a strict minimum frame size of 4096 bytes to prevent pathological packet fragmentation. While the library defines a frameMinSize = 4096 constant, the...

github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via AMQP frame size negotiation

A flaw was found in RabbitMQ amqp091-go, a Go AMQP 0.9.1 client. A malicious or compromised AMQP broker can exploit this by advertising an extremely small frame size during connection negotiation. This can lead to excessive fragmentation of client publications, consuming significant CPU resources...

CVE-2026-91964

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can exploit a heap-based buffer overflow vulnerability in the negosendnegotiationrequest function. By sending a specially crafted Server Redirection PDU message with an attacker-controlled LoadBalanceInfo field, the serve...

CVE-2026-91955

A flaw was found in FreeRDP. FreeRDP contains a flaw where it fails to validate client-supplied desktop dimensions during the Graphics Command Channel GCC negotiation. A remote attacker can exploit this by sending crafted Remote Desktop Protocol RDP packets with zero or oversized dimensions. This...

DEBIAN-CVE-2026-91955

FreeRDP before 3.31.0 fails to validate client-supplied DesktopWidth and DesktopHeight values during GCC negotiation, allowing remote attackers to crash the server. Attackers can send crafted RDP packets with zero or oversized dimensions to trigger division-by-zero or assertion failures in...

CVE-2026-91955

FreeRDP before 3.31.0 fails to validate client-supplied DesktopWidth and DesktopHeight values during GCC negotiation, allowing remote attackers to crash the server. Attackers can send crafted RDP packets with zero or oversized dimensions to trigger division-by-zero or assertion failures in...

DEBIAN-CVE-2026-91949

FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS...

CVE-2026-91949

FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS...

CVE-2026-91949

FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS...

UBUNTU-CVE-2026-91955

FreeRDP before 3.31.0 fails to validate client-supplied DesktopWidth and DesktopHeight values during GCC negotiation, allowing remote attackers to crash the server. Attackers can send crafted RDP packets with zero or oversized dimensions to trigger division-by-zero or assertion failures in...

UBUNTU-CVE-2026-91949

FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS...

CVE-2026-91955

FreeRDP before 3.31.0 fails to validate client-supplied DesktopWidth and DesktopHeight values during GCC negotiation, allowing remote attackers to crash the server. Attackers can send crafted RDP packets with zero or oversized dimensions to trigger division-by-zero or assertion failures in...

CVE-2026-91964

FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in negosendnegotiationrequest when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written...