kernel: sctp: diag: reject stale associations in dump_one path

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP diagnostics. When performing a socket diagnostic sockdiag lookup, the system may attempt to access memory related to an SCTP association that has already been freed. This can lead to an out-of-bounds read from...

kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A remote attacker could exploit this by sending a specially crafted COOKIEECHO chunk to a listening SCTP server. The server's failure to properly validate the length of a cached peer INIT chunk within...

kernel: netfilter: nf_log: validate MAC header was set before dumping it

A flaw was found in the Linux kernel's netfilter logging component. This vulnerability occurs because the system does not properly check if a network packet's Media Access Control MAC header is valid before attempting to log it. A local attacker could send a specially crafted network packet,...

kernel: security/keys: fix missed RCU read section on lookup

A flaw was found in the Linux kernel's keyring code. The assocarrayfind function, used for looking up keys, was called without holding the necessary Read-Copy-Update RCU read lock. This oversight allows for a memory corruption vulnerability, particularly affecting persistent key handling, as the...

AtomicMemory

Implementación FPGA de Referencia Cyclone V Este directorio contiene los módulos RTL de referencia, las imágenes FPGA precompiladas y los scripts de prueba TCL opcionales para la primitiva atómica de medición–colapso. Esta primitiva es un mecanismo de hardware de medición–colapso compatible con...

httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions

A flaw was found in the modproxyajp module of httpd. When processing AJP Apache JServ Protocol messages, the AJP getter functions attempt to read data beyond the allocated buffer size, allowing an attacker or a malformed request to cause an out-of-bounds read. This issue leads to a denial of...

httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data()

A flaw was found in the modproxyajp module of httpd. When processing AJP Apache JServ Protocol messages, the ajpparsedata function attempts to read data beyond the allocated buffer size, allowing an attacker or a malformed request to cause a heap-based buffer over-read. This issue potentially lea...

httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime

A flaw was found in Apache HTTP Server. An out-of-bounds read vulnerability exists when modheaders and modmime are used with multiple response languages. This could allow a remote attacker to disclose sensitive information from memory or cause a denial of service...

httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server

A flaw was found in Apache HTTP Server. This buffer over-read vulnerability occurs when the server processes outbound Online Certificate Status Protocol OCSP requests directed to an attacker-controlled OCSP server. This could allow a remote attacker to read sensitive information from memory or...

httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check

A flaw was found in the modproxyajp module of httpd. When processing AJP Apache JServ Protocol messages, the server fails to properly check if a string is null-terminated before attempting to read it, allowing an attacker or a malformed request to cause a heap-based buffer over-read. This issue...

kernel: sctp: diag: reject stale associations in dump_one path

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP diagnostics. When performing a socket diagnostic sockdiag lookup, the system may attempt to access memory related to an SCTP association that has already been freed. This can lead to an out-of-bounds read from...

kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done

A flaw was found in the Linux kernel. A remote attacker could exploit a use-after-free vulnerability in the Transparent Inter-Process Communication TIPC cryptographic decryption process. This flaw occurs when a network namespace, a mechanism for isolating network resources, is deallocated before ...

kernel: sctp: fix auth_hmacs array size in struct sctp_cookie

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. An incorrect array size calculation for the authhmacs field within the sctpcookie structure could lead to a buffer overflow. During the initialization of an SCTP association, if four HMAC identifiers...

kernel: netfilter: nf_log: validate MAC header was set before dumping it

A flaw was found in the Linux kernel's netfilter logging component. This vulnerability occurs because the system does not properly check if a network packet's Media Access Control MAC header is valid before attempting to log it. A local attacker could send a specially crafted network packet,...

kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A remote attacker could exploit this by sending a specially crafted COOKIEECHO chunk to a listening SCTP server. The server's failure to properly validate the length of a cached peer INIT chunk within...

RLSA-2026:65897 Important: qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fixes: qt: Qt: Denial of Service via out-of-bounds read in text codec handling CVE-2026-9499 For more details about the security issues, including t...

qt5-qtbase security update

An update is available for qt5-qtbase. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Qt is a software toolkit for developing applications. The qt5-base package...

CVE-2026-36851

CVE-2026-36851 Path traversal / lectura arbitraria de archivos en UnPoller v2.33.0 a través del prefijo file:// en la contraseña. El contenido de los archivos se lee del disco y se transmite a la URL del controlador UniFi configurada durante la autenticación...

CVE-2022-46364---Apache-CXF-XOP-Include-LFI-PoC

Apache CXF XOP Include 本地文件包含 CVE-2022-46364 概述 本仓库包含针对 CVE-2022-46364 的概念验证 PoC 利用程序，这是 Apache CXF 中的一个本地文件包含 LFI 漏洞。 该漏洞是由于 SOAP 请求中 XOP（XML 二进制优化打包）Include 元素处理不当引起的，允许攻击者读取服务器上的任意文件。 漏洞详情 CVE ID: CVE-2022-46364 组件: Apache CXF 漏洞类型: 本地文件包含 LFI 攻击向量: 远程（某些情况下无需认证） 影响: 服务器任意文件读取 根本原因 Apache CXF...

WordPress-File-Upload-4.24.11---Unauthenticated-Path-Traversal

WordPress-File-Upload-4.24.11---Unauthenticated-Path-Traversal CVE-2024-9047 Una herramienta de seguridad basada en Python para detectar y explotar una vulnerabilidad de lectura arbitraria de archivos en el plugin WP File Upload de WordPress versiones = 4.24.11...