LOLBins

LOLBins Aplicación PyQT para listar todos los Binarios y Scripts Living Off The Land para Windows desde LOLBAS y binarios Unix que pueden usarse para evitar restricciones de seguridad locales en sistemas mal configurados desde GTFOBins. Windows Linux...

ophcrack

OPHCRACK 3.6.0 Time-Memory-Trade-Off-Crack Un crackeador de contraseñas de Windows basado en el compromiso tiempo-memoria más rápido usando tablas arcoíris. Esta es una evolución del ophcrack 1.0 original desarrollado en EPFL http://lasecwww.epfl.ch/oechslin/projects/ophcrack Ophrack 3.6.0 viene...

challack

Proof-of-concept code for CVE-2016-5696 This code currently allows reseting connections or injecting into sessions. The attack is implemented against both clients and servers. For detailed information, consult the original publication: Off-Path TCP Exploits: Global Rate Limit Considered Dangerous...

CVE-2026-8389

CVE-2026-8389 This vulnerability was intended to be used at Pwn2Own 2026 Berlin, but was patched in version 150.0.3. SpiderMonkey BaselineJIT pcOffset bitfield truncation on the eager off-thread baseline-compile path, leading to a wrong-but-in-bounds bytecode pc during exception unwinding and a...

QuasarNix

QuasarNix: Adversarially Robust Living-off-the-Land Reverse-Shell Detection Dmitrijs Trizna · Luca Demetrio · Battista Biggio · Fabio Roli Overview Linux living-off-the-land LOTL reverse shells abuse legitimate binaries bash, python, nc, … to establish covert outbound connections, making...

OESA-2026-3705 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: fix off-by-one in dlmmatchregions region comparison The local-vs-remote region comparison loop uses '=' instead of '', causing it to read one entry pa...

Astra Linux – Vulnerability in Zabbix

The researcher has shown that due to the way the SNMP trap log is parsed, an attacker can create an SNMP trap with additional lines of information, causing forged data to appear in the Zabbix UI. This attack requires that SNMP authentication be disabled, and/or that the attacker knows the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: rcv: Fixed an oops caused by the irqsoff latency tracer. The tracehardirqson,off functions require the caller to properly set up the frame pointer. This is because these two functions use the macro CALLERADDR1 also known as...

Astra Linux – Vulnerability in Corosync

Corosync versions up to 3.1.9 suffer from a stack-based buffer overflow in the orftokenendianconvert function, in the exec/totemsrp.c file. This vulnerability exists when encryption is disabled or if the attacker knows the encryption key. The issue is caused by a large UDP packet...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: scsi: sd: A “off-by-one” error has been fixed in sdreadBlockcharacteristics. If the device returns page 0xb1 with a length of 8 this occurs with QEMU v2.x, for example, sdReadBlockCharacteristics may attempt an out-of-bounds...

OBO

Off-By-One Diapositivas de las conferencias Off-By-One Ver todas las charlas Año ↓| Diapositivas| Lista de reproducción de YouTube ---|---|--- 2024| Diapositivas del Día 1...

Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-3156

Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-3156 Version Vulnarable To The Exploit The Baron Samedit vulnerability CVE-2021-3156 affects sudo legacy versions 1.8.2 through 1.8.31p2 and stable versions 1.9.0 through 1.9.5p1. This heap-based buffer overflow flaw was introduced in July 2011 via comm...

CVE-2022-3602

CVE−2022-3602 What is this? This document and repository is a write-up of CVE−2022-3602, a punycode buffer overflow issue in OpenSSL. It's an "anti-POC" the issue does not appear to exploitable intended for folks who maintain their own OpenSSL builds and for compiler maintainers. There is a...

CVE-2021-3156

CVE-2021-3156 - Heap-Based Buffer Overflow in Sudo ⚠️ For educational and authorized security research purposes only Original Exploit Authors Very grateful to the original PoC author Qualys Research Team Description Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based...

CVE-2026-90781

A flaw was found in alsa-lib. This vulnerability is an off-by-one stack buffer overflow in the sndctlasciielemidparse function. A local attacker can exploit this by supplying a specially crafted, long control-element identifier string through saved state files or command-line arguments. This can...

faraday-client

================ This is deprecated please use Faraday-Cli instead!!! v1.1.0 was a hand-off release, updating only accessing Faraday using API v3 v2 will be deprecated too. ================== Faraday GTK Client .. image:: https://img.shields.io/pypi/v/faradayclient.svg :target:...

CVE-2006-3747

Archivos sobre mi publicación en bugtraq y el primer exploit funcional para CVE-2006-3747 desbordamiento off-by-one en modrewrite LDAP de Apache. http://www.securityfocus.com/archive/1/443870 Fecha de publicación del POC/Exploit: 2006-08-20 Autor: Jacobo Avariento Gimeno ID de CVE: CVE-2006-3747 ...

cve-2010-1938

🚀 CVE-2010-1938 FTP Off-by-One Exploit A simple Python script to test an off-by-one vulnerability in the OPIE library CVE-2010-1938. This vulnerability affects certain FTP servers and may allow for Denial of Service DoS or arbitrary code execution. 📜 Description This script targets a known...

httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions

A flaw was found in the modproxyajp module of httpd. When processing AJP Apache JServ Protocol messages, the AJP getter functions attempt to read data beyond the allocated buffer size, allowing an attacker or a malformed request to cause an out-of-bounds read. This issue leads to a denial of...

CVE-2026-81012

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix off-by-one write in hpgetstringfrombuffer hpgetstringfrombuffer clamps the converted string length against the destination buffer size with "size dstsize", so when the converted length is exactly equ...