kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A remote attacker could exploit this by sending a specially crafted COOKIEECHO chunk to a listening SCTP server. The server's failure to properly validate the length of a cached peer INIT chunk within...

kernel: sctp: diag: reject stale associations in dump_one path

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP diagnostics. When performing a socket diagnostic sockdiag lookup, the system may attempt to access memory related to an SCTP association that has already been freed. This can lead to an out-of-bounds read from...

kernel: netfilter: nf_log: validate MAC header was set before dumping it

A flaw was found in the Linux kernel's netfilter logging component. This vulnerability occurs because the system does not properly check if a network packet's Media Access Control MAC header is valid before attempting to log it. A local attacker could send a specially crafted network packet,...

kernel: security/keys: fix missed RCU read section on lookup

A flaw was found in the Linux kernel's keyring code. The assocarrayfind function, used for looking up keys, was called without holding the necessary Read-Copy-Update RCU read lock. This oversight allows for a memory corruption vulnerability, particularly affecting persistent key handling, as the...

AtomicMemory

参考 FPGA 实现 Cyclone V 本目录包含参考 RTL 模块、预编译的 FPGA 镜像以及可选的 TCL 测试脚本，用于实现原子测量–塌缩原语。该原语是一种 CMOS 兼容的硬件测量–塌缩机制，强制实现单次读取语义：第一次合格的读取返回存储的字节，而测量行为会确定性地触发不可逆的塌缩事件。塌缩后，单元仅产生混淆或基于 PRNG 的输出，确保原始值无法恢复。该实现展示了确定性首次读取披露、基于基态条件的访问控制以及独立存储单元组上的原子单向状态转换。 提供的 .sof 文件允许直接进行硬件验证，无需任何额外的总线接口模块。 状态： 研究工件发布 许可证：...

httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data()

A flaw was found in the modproxyajp module of httpd. When processing AJP Apache JServ Protocol messages, the ajpparsedata function attempts to read data beyond the allocated buffer size, allowing an attacker or a malformed request to cause a heap-based buffer over-read. This issue potentially lea...

httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions

A flaw was found in the modproxyajp module of httpd. When processing AJP Apache JServ Protocol messages, the AJP getter functions attempt to read data beyond the allocated buffer size, allowing an attacker or a malformed request to cause an out-of-bounds read. This issue leads to a denial of...

httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server

A flaw was found in Apache HTTP Server. This buffer over-read vulnerability occurs when the server processes outbound Online Certificate Status Protocol OCSP requests directed to an attacker-controlled OCSP server. This could allow a remote attacker to read sensitive information from memory or...

httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime

A flaw was found in Apache HTTP Server. An out-of-bounds read vulnerability exists when modheaders and modmime are used with multiple response languages. This could allow a remote attacker to disclose sensitive information from memory or cause a denial of service...

httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check

A flaw was found in the modproxyajp module of httpd. When processing AJP Apache JServ Protocol messages, the server fails to properly check if a string is null-terminated before attempting to read it, allowing an attacker or a malformed request to cause a heap-based buffer over-read. This issue...

kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done

A flaw was found in the Linux kernel. A remote attacker could exploit a use-after-free vulnerability in the Transparent Inter-Process Communication TIPC cryptographic decryption process. This flaw occurs when a network namespace, a mechanism for isolating network resources, is deallocated before ...

kernel: sctp: fix auth_hmacs array size in struct sctp_cookie

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. An incorrect array size calculation for the authhmacs field within the sctpcookie structure could lead to a buffer overflow. During the initialization of an SCTP association, if four HMAC identifiers...

kernel: sctp: diag: reject stale associations in dump_one path

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP diagnostics. When performing a socket diagnostic sockdiag lookup, the system may attempt to access memory related to an SCTP association that has already been freed. This can lead to an out-of-bounds read from...

kernel: netfilter: nf_log: validate MAC header was set before dumping it

A flaw was found in the Linux kernel's netfilter logging component. This vulnerability occurs because the system does not properly check if a network packet's Media Access Control MAC header is valid before attempting to log it. A local attacker could send a specially crafted network packet,...

kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A remote attacker could exploit this by sending a specially crafted COOKIEECHO chunk to a listening SCTP server. The server's failure to properly validate the length of a cached peer INIT chunk within...

RLSA-2026:65897 Important: qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fixes: qt: Qt: Denial of Service via out-of-bounds read in text codec handling CVE-2026-9499 For more details about the security issues, including t...

qt5-qtbase security update

An update is available for qt5-qtbase. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Qt is a software toolkit for developing applications. The qt5-base package...

CVE-2022-46364---Apache-CXF-XOP-Include-LFI-PoC

Apache CXF XOP Include 本地文件包含 CVE-2022-46364 概述 本仓库包含针对 CVE-2022-46364 的概念验证 PoC 利用程序，这是 Apache CXF 中的一个本地文件包含 LFI 漏洞。 该漏洞是由于 SOAP 请求中 XOP（XML 二进制优化打包）Include 元素处理不当引起的，允许攻击者读取服务器上的任意文件。 漏洞详情 CVE ID: CVE-2022-46364 组件: Apache CXF 漏洞类型: 本地文件包含 LFI 攻击向量: 远程（某些情况下无需认证） 影响: 服务器任意文件读取 根本原因 Apache CXF...

WordPress-File-Upload-4.24.11---Unauthenticated-Path-Traversal

WordPress-File-Upload-4.24.11---Unauthenticated-Path-Traversal CVE-2024-9047 一个基于Python的安全工具，用于检测和利用WordPress WP File Upload插件（版本 = 4.24.11）中的任意文件读取漏洞。...

CVE-2025-13834-A-Bluetooth-RFCOMM-Out-of-Bounds-Read-Vulnerability-in-Modern-Wireless-Devices

= doi.org/10.5281/zenodo.18323302 = orcid.org/0009-0007-7728-256X README.md：CVE-2025-13834 RFCOMM 蓝牙“心血”漏洞利用框架 作者： Sastra Adi Wiguna（紫色精英团队） 日期： 2026年1月20日 版本： 1.0（全系统复现） 许可证： 仅供红队使用 （未经授权不得分发） 🔴 执行摘要 CVE-2025-13834 是 RFCOMM 蓝牙协议栈中的一个关键内存泄露漏洞 ，类似于 Heartbleed（CVE-2014-0160） ，但影响 28 亿台支持蓝牙的设备...