CVE-2022-0778-POC

一个针对 CVE-2022-0778 的简单远程触发 POC 为什么 在尝试验证我们这边的服务器实现是否受到 CVE-2022-0778 影响时，发现远程验证极其繁琐。虽然关于如何构造恶意证书来触发 BNnodsqrt 中的解析漏洞的教程早已存在，但主要问题在于大多数客户端实现会尝试解析客户端证书以便在 TLS 握手中使用它。这反过来意味着： 如果实现存在漏洞，该漏洞会被触发，客户端将占用 100% CPU 并停滞。 如果实现不存在漏洞，则无法解析证书，客户端会理所当然地退出。 是什么 实际需要的是能够在 TLS 握手中注入一条消息，从而替换客户端在响应 CertificateReque...

CVE-2026-45762

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's IP defragmentation tracker lookup did not verify that an existing tracker used the same IP address family as the packet being...

CVE-2026-88289 GV-LPC2011/LPC2211 - Multiple Pre-Authentication Stack Buffer Overflows in VLSVR Request Handlers

GeoVision GV-LPC2211 V1.14 260903 fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VLSVR request handlers, allowing an unauthenticated remote attacker to crash the VLSVR service...

httpd: NULL pointer dereference via specially crafted request

A flaw was found in the moddavlock module of httpd. This vulnerability allows a remote unauthenticated attacker to crash the server due to a NULL pointer dereference via a specially crafted request...

CVE-2026-23398

CVE-2026-23398 Linux 内核 icmptagvalidation 空指针解引用（远程拒绝服务） 描述 net/ipv4/icmp.c 中的 icmptagvalidation 在解引用 inetprotosproto 时未进行 NULL 检查。远程攻击者可以发送单个精心构造的 ICMP Fragmentation Needed 数据包，其中包含未注册的内部协议号，从而在 softirq 上下文中使内核崩溃。 受影响版本：提交 614aefe56af8（主线）之前的 Linux 内核 / d938dd5a0ad7（稳定版 6.12）之前的版本 用法...

CVE-2026-20404-MediaTek-modem-remote-DoS-rogue-base-station-scenario-

CVE-2026-20404-MediaTek-modem-remote-DoS-rogue-base-station-scenario- MediaTek 调制解调器存在输入验证问题，当 UE 连接到攻击者控制的恶意基站时，可能导致系统崩溃（远程拒绝服务），且无需用户交互。 提供的 check.sh 代码用于： 1. 识别受影响的芯片/设备 2. 确认补丁级别/公告是否已应用 3. 记录威胁模型（可用性影响、恶意基站前提条件） 执行方式 - bash ./check.sh 分析...

CVE-2026-22591

eProsima Fast DDS , a C++ implementation of the OMG DDS standard, is affected by a remote denial-of-service vulnerability in its DDSSQLFilter (SQL-based content filtering) component. The root cause is recursive parser stack exhaustion triggered by a deeply nested filter expression in the PID_CONT...

CVE-2026-22591 Fast DDS DDSSQLFilter Recursive Parser Stack Exhaustion (Remote DoS)

eprosima Fast DDS is a C++ implementation of the DDS Data Distribution Service standard of the OMG Object Management Group. Prior to versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3, Fast DDS’s implementation of SQL‑based content filtering DDSSQLFilter allows any participant in a DDS domain to remotely...

check_icmp_dos

checkicmpdos iOS 12 / OS X Remote Kernel Heap Overflow CVE-2018-4407 POC： root@kitploit: pip install scapy sudo scapy sendIPdst=“Target IP“,options=IPOption“A”8/TCPdport=2323,options=19, “1"18,19, “2”18 或使用脚本 root@kitploit: python checkicmpdos.py 127.0.0.1...

CVE-2024-54085

CVE-2024-54085：AMI MegaRAC BMC 中的关键身份验证绕过漏洞 受影响系统 该漏洞影响多家主要制造商的广泛服务器硬件： AMI MegaRAC SPx ：12.x 至 12.7 版本和 13.x 至 13.5 版本 HPE Cray XD670 ：1.09、1.13、1.17 版本 Asus RS720A-E11-RS24U ：1.2.27 版本 ASRockRack ：服务器 Supermicro ：服务器 众多其他使用 AMI BMC 的领先制造商服务器 技术利用细节 漏洞位于以下文件中： root@kitploit:...

CVE-2022-36234

CVE-2022-36234 描述 SimpleNetwork TCP Server 的 commit 29bc615f0d9910eb2f59aa8dff1f54f0e3af4496 被发现包含一个双重释放漏洞，可通过精心构造的 TCP 数据包加以利用。触发该双重释放漏洞可使客户端远程崩溃任何 SimpleNetwork TCP 服务器。在其他情况下，双重释放漏洞可能导致未定义行为，并在适当条件下可能执行代码。 复现 为确保你拥有编译该库所需的标准构建工具，请安装以下软件包（在大多数系统上这些工具通常已安装）： root@kitploit: sudo apt-get install...

CVE-2026-32945

CVE-2026-32945 PJSIP DNS 压缩指针堆越界读取（远程拒绝服务） 描述 pjlib-util/src/pjlib-util/dns.c 中的 getnamelen 和 getname 通过 pjmemcpy&offset, p, 2 读取一个 2 字节的 DNS 压缩指针，但未检查这两个字节是否都位于数据包缓冲区之内。当 0xC0 字节（压缩指针标记）恰好是 DNS 响应的最后一个字节时，memcpy 会读取超出堆分配边界的一个字节。 单个 20 字节的精心构造的 DNS 响应即可触发越界读取，并使任何通过网络控制的 DNS 服务器解析域名的 PJSIP 应用程序（包...

CVE-2026-35333

CVE-2026-35333 strongSwan RADIUS attribute-iterator bucle infinito pre-autenticación / DoS remoto. Descripción attributeenumerate en src/libradius/radiusmessage.c:247-271 acepta atributos RADIUS cuyo byte length es menor que sizeofrattrt 2. Para length == 0: data-len = next-length - sizeofrattrt...

EUVD-2026-74620

An issue was discovered in the utcp package before 0.0.6 for OCaml. Out-of-order segment reassembly allows remote denial of service...

kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

A flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol L2CAP implementation. A remote Bluetooth Low Energy BLE device can exploit this by sending a specially crafted L2CAP ECRED reconfiguration response. This can lead to the corruption of the channel list,...

The vulnerability of the smc_v2_determine_accepted_chid() function in the net/smc/af_smc.c module of the SMC protocol family in the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability of the smcv2determineacceptedchid function in the net/smc/afsmc.c module of the SMC protocol family in the Linux operating system’s kernel is related to the use of pointers. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

CVE-2022-30780-lighttpd-denial-of-service

CVE-2022-30780 - lighttpd 远程拒绝服务 CVE-2022-30780 - lighttpd 远程拒绝服务 概述 未经身份验证的攻击者可以发送一个 URL 超过最大 URL 长度的 HTTP 请求，从而导致拒绝服务。 受影响的版本 以下版本的 lighttpd 存在漏洞： 软件| 版本| 受影响 ---|---|--- Lighttpd| 1.4.58| 是 ✅ Lighttpd| 1.4.57| 是 ✅ Lighttpd| 1.4.56| 是 ✅ 用法 root@kitploit: $...

CVE-2026-45527

In convertCleanApertureToRect of HeifCleanAperture.cpp, there is a possible way to cause a temporary denial of service due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28666

In multiple functions of LocalImageResolver.java, there is a possible Remote Persistent Denial of Service due to a DNG image rendering check bypass. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-74016

In parsePartHeaders of multiple files, there is a possible persistent denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...