598 matches found
CVE-2024-51179
CVE-2024-51179：攻击者发送的精心构造的数据包泛滥可导致 Open5gs 中的 UPF/SMF 崩溃 漏洞描述 描述： Open 5GS v.2.7.1 中存在一个问题，允许远程攻击者通过网络功能虚拟化（NFV）中的用户面功能（UPF）和会话管理功能（SMF）引发拒绝服务。分组数据单元（PDU）会话建立过程受到 NFV 内部崩溃的影响。 攻击者在获取用户面功能（UPF）的 IP 地址、PFCP 端口和 SEID（会话端点标识符）后，可以构造并发送大量恶意 PFCP（分组转发控制协议）数据包到 UPF。如果攻击者能够访问用户面流量，则可使用 Wireshark 等工具截获所需参...
CVE-2022-33174
CVE-2022-33174 Powertek PDU身份绕过 Optional Arguments: -h, --help show this help message and exit -u url, --url url Target url eg:"http://127.0.0.1" -f file, --file file Targets in file eg:"ip.txt" Use python3 CVE-2022-33174.py -u http://127.0.0.1 python3 CVE-2022-33174.py -f ip.txt Link...
CVE-2026-89480 nvme-tcp: reject a read that transferred too few bytes
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvmetcprecvdata completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct...
PT-2026-90353
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF and buffer leak in cifs check trans2 for malformed secondary T2 When a valid primary TRANSACT2 response has been received mid-resp buf set, mid-multiRsp true and a subsequent secondary response causes cifs...
ManageEngine OpManager SumPDU 12.1 - 12.5.232 - Java Deserialization
Zoho ManageEngine OpManager Stable build before 125203 and Released build before 125233 allows Remote Code Execution via the Smart Update Manager SUM servlet. id: CVE-2020-28653 info: name: ManageEngine OpManager SumPDU 12.1 - 12.5.232 - Java Deserialization author: iamnoooob,pdresearch severity:...
CVE-2019-0708
Leaving for a wedding tomorrow, if I can't find anything then someone else take the reins Going to drop the crash PoC here Friday if there isnt one public already... Maybe the following week, depending on if the vulnerable numbers drop consistently or not. https://vimeo.com/339425966 I'm not...
CVE-2026-80798
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: reject PDUs shorter than the LLCP header Every LLCP PDU begins with a two-byte header DSAP/SSAP + PTYPE, but the receive path never checked that a frame is at least LLCPHEADERSIZE bytes before parsing it. nfcllcprxskb...
CVE-2026-80798 nfc: llcp: reject PDUs shorter than the LLCP header
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: reject PDUs shorter than the LLCP header Every LLCP PDU begins with a two-byte header DSAP/SSAP + PTYPE, but the receive path never checked that a frame is at least LLCPHEADERSIZE bytes before parsing it. nfcllcprxskb...
CVE-2026-80798
CVE-2026-80798 affects the Linux kernel NFC LLCP subsystem . The receive path in nfc_llcp_rx_skb() never validated that a frame is at least LLCP_HEADER_SIZE bytes before parsing. When a short frame is received, the computation skb->len - LLCP_HEADER_SIZE underflows (as size_t), causing the TLV...
CVE-2026-85089
FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...
UBUNTU-CVE-2026-85089
FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...
CVE-2026-85089
FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...
CVE-2026-85089
FreeRDP versions 3.0.0 through 3.30.0 are affected by an information disclosure vulnerability in the Save Session Info PDU writers within libfreerdp/core/info.c. Three functions (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) use Stream_Seek instead of Stream_Ze...
EUVD-2026-70299
FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...
CVE-2026-85089 FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory
FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...
CVE-2026-85089 FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory
FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...
FreeRDP: FreeRDP: Denial of Service and heap corruption via malformed RDP audio PDU
A flaw was found in FreeRDP. An authenticated Remote Desktop Protocol RDP client can send a specially crafted Client Audio Formats Protocol Data Unit PDU to the server. This malformed PDU can cause a double-free vulnerability in the rdpsndserverrecvformats function, leading to the server reliably...
FreeRDP: FreeRDP: Authentication bypass via incorrect RDSTLS PDU handling
A vulnerability in FreeRDP's server-side RDSTLS allows remote, unauthenticated attackers to bypass authentication. By sending a crafted capabilities PDU instead of the expected authentication request, an attacker can gain an authenticated session without valid credentials...