CVE-2021-3156

CVE-2021-3156 Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via sudoedit -s and a command-line argument that ends with a single backslash character. Credit to: Advisory by Baron Samedit of Qualys How to...

CVE-2022-3602

CVE−2022-3602 What is this? This document and repository is a write-up of CVE−2022-3602, a punycode buffer overflow issue in OpenSSL. It's an "anti-POC" the issue does not appear to exploitable intended for folks who maintain their own OpenSSL builds and for compiler maintainers. There is a...

Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-3156

Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-3156 Version Vulnarable To The Exploit The Baron Samedit vulnerability CVE-2021-3156 affects sudo legacy versions 1.8.2 through 1.8.31p2 and stable versions 1.9.0 through 1.9.5p1. This heap-based buffer overflow flaw was introduced in July 2011 via comm...

cve-2016-6187-poc

poc for https://duasynt.com/blog/cve-2016-6187-heap-off-by-one-exploit...

CVE-2026-114460

A flaw was found in modqos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this...

EUVD-2026-108024

A flaw was found in modqos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this...

cve-2010-1938

🚀 CVE-2010-1938 FTP Off-by-One Exploit A simple Python script to test an off-by-one vulnerability in the OPIE library CVE-2010-1938. This vulnerability affects certain FTP servers and may allow for Denial of Service DoS or arbitrary code execution. 📜 Description This script targets a known...

CVE-2026-98675

A flaw was found in the Linux kernel's Analog Devices ADE9000 driver. An off-by-one error in the interrupt handler sets an incorrect upper bound when scanning device status events. Consequently, the driver fails to detect and report Phase C power dip events to the operating system, preventing...

cve-2021-3156

CVE-2021-3156 -- Baron Samedit Vulnerability Environment Create the image using Dockerfile docker build -t cve-2021-3156:ubuntu2004 . Create a container using the image docker run --rm -it cve-2021-3156:ubuntu2004 /bin/bash Vulnerability Cause In Sudo versions prior to 1.9.5p2 , there is an...

CVE-2026-114460

A flaw was found in modqos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this...

CVE-2023-40296

CVE-2023-40296 async-sockets-cpp through 0.3.1 contains an off-by-one buffer overflow vulnerability in static void ReceiveFromUDPSocket udpSocket at udpsocket.hpp, around lines 160-167. The buffer overflow affects all corresponding UDP servers. The remote buffer overflow can be triggered by...

CVE-2026-93242

A flaw was found in the Linux kernel's qla2xxx Fibre Channel driver. When handling multi-entry response packets, an off-by-one counting error causes the driver to consume an extra entry from the response queue. This issue can cause legitimate firmware responses to be prematurely marked as process...

CVE-2026-93166

A flaw was found in the wifi: rtw89 driver of the Linux kernel. An off-by-one error in the rtw89ppdustr function, due to an incorrect comparison, can lead to an out-of-bounds access. This vulnerability could potentially result in a denial of service or information disclosure...

CVE-2026-93064

A flaw was found in the iwlwifi driver of the Linux kernel. An off-by-one error in the iwlmvmfrobtxfkeyiter function, responsible for sanitizing transmit TXF keys, incorrectly calculates the memory clear operation's starting point. This error results in one byte before the intended key being...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53263)

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix off-by-one in multicast context address compression The second memcpy in lowpaniphcmcastctxaddrcompress uses &data1 as destination and &ipaddr-s6addr11 as source, but both should be offset by one: &data2 and...

CVE-2026-12727

IBM MQ could allow an authenticated attacker to cause potential process instability due to an off-by-one buffer overflow when processing specially crafted object names...

CVE-2006-3747

Files about my bugtraq publication and first working exploit for CVE-2006-3747 Apache modrewrite LDAP off-by-one buffer overflow. http://www.securityfocus.com/archive/1/443870 Public release date of POC/Exploit: 2006-08-20 Author: Jacobo Avariento Gimeno CVE id: CVE-2006-3747 Bugtraq id: 19204 CE...

OBO

OB1 Off-By-One Slides from OB1 Conferences Watch all the talks Year ↓| Slides| Youtube playlist ---|---|--- 2024| Slides for Day 1| Day 1 - OB1 2024 Online Presentations 2024| Slides for Day 2| Day 2 - OB1 2024 Online Presentations 2025| Slides for Day 1| Day 1 - OB1 2025 Online Presentations 202...

CVE-2021-3156

CVE-2021-3156 - Heap-Based Buffer Overflow in Sudo ⚠️ For educational and authorized security research purposes only Original Exploit Authors Very grateful to the original PoC author Qualys Research Team Description Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based...

CVE-2026-98675 iio: adc: ade9000: handle Phase C dip events in IRQ1 handler

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ade9000: handle Phase C dip events in IRQ1 handler ADE9000ST1CROSSINGDEPTH is the exclusive upper bound for scanning the STATUS1 event bits, so a value of 25 left out the highest event bit, ADE9000ST1DIPCBIT bit 25. Pha...