CVE-2023-29336

CVE-2023-29336 - Win32k 本地权限提升 - PoC 有关微软 Windows 中一个现已修复且曾被积极利用的安全漏洞的细节浮出水面，该漏洞可被威胁行为者利用，在受影响的系统上获取提升的权限。 该漏洞编号为 CVE-2023-29336，严重性评分为 7.8，涉及 Win32k 组件中的一个权限提升漏洞。 “成功利用此漏洞的攻击者可以获得 SYSTEM 权限，”微软在上个月作为补丁星期二更新的一部分发布的安全公告中透露。 Avast 研究员 Jan Vojtěšek、Milánek 和 Luigino Camastra 因发现并报告该漏洞而受到致谢。 Win32k.s...

frida-stalker-NtStrace

NtStrace frida-stalker based system call tracer on windowsx64. 483NtWaitForWorkViaWorkerFactory test.exe!0x7ff91fbaf262 35NtQueryVirtualMemory test.exe!0x7ff91fbaf262 35NtQueryVirtualMemory test.exe!0x7ff91fbaf262 35NtQueryVirtualMemory test.exe!0x7ff91fbb06d2 199NtCreateThreadEx + Following thre...

CVE-2024-38077

CVE-2024-38077 Aquí hay una posible descripción de GitHub para CVE-2024-38077: CVE-2024-38077: Vulnerabilidad de ejecución remota de código en el servicio de licencias de escritorio remoto de Windows Resumen: CVE-2024-38077 es una vulnerabilidad crítica en el Servicio de licencias de escritorio...

iDevice_ZH

iDevice ？ 基于Google Project Zero的Ian Beer发现的强大漏洞CVE-2025-24203无需越狱 进行系统级调整 ✅ iOS 16.0 – iOS 18.3.2 使用CVE-2025-24203 ✅ iOS 16.0 - 18.5 支持文件管理器和IPA调整注入器...

CVE-2022-33075

CVE-2022-33075 漏洞利用标题：Zoo Management System 1.0 - 存储型跨站脚本（XSS） 日期：05/26/2022 漏洞利用作者：Angelo Pio Amirante 厂商主页：https://www.sourcecodester.com/ 软件链接：https://www.sourcecodester.com/php/15344/zoo-management-system-phpoop-free-source-code.html 版本：1.0 测试环境：服务器：XAMPP CVE：2022-33075 描述： Zoo Management...

kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst

A flaw was found in the Linux kernel's netfilter component, specifically within the nfqueue functionality. When a bridged packet is queued to NFQUEUE, it can retain a reference to a bridge's private fake destination 'dst' even after the bridge teardown has begun. This can lead to a use-after-free...

kernel: ipvs: clear the svc scheduler ptr early on edit

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. During the ipvseditservice operation, the svc-scheduler pointer is cleared too late when unbinding an old scheduler. This improper handling allows packets to access previously freed scheduler data, leading to a use-after-fre...

CVE-2016-3309_Reloaded

内核利用案例研究 - Win10 x64 RS2 上的“野性”池溢出（CVE-2016-3309 Reloaded） 这个 Github 仓库包含针对近期已修补的 win32kfull!bFill 漏洞的利用程序。执行 Palette 或 Bitmap 利用程序将赋予你在受影响系统上的 SYSTEM 权限。这些利用程序应该可以在安装了 Creators Update、版本号为 15063.540 的 Windows 10 x64 上正常工作（这是微软九月更新发布之前最新的 Win10 版本）。 该 Visual Studio 解决方案包含三个利用程序：...

CVE-2024-3400

CVE-2024-3400：操作系统命令注入漏洞 描述： CVE-2024-3400 是一个安全漏洞，影响那些接受用户输入并根据该输入执行操作系统命令，但缺乏充分验证的应用程序或服务。此漏洞允许攻击者通过接收到的输入注入恶意或破坏性的操作系统命令，可能导致系统被利用、数据被篡改，甚至完全控制易受攻击的系统。 更多信息和更新，请参考 CVE-2024-3400。 注意 请等待响应结果。响应需要相当长的时间...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: jfs: Fixed an out-of-bounds issue in dbNextAG and diAlloc. In dbNextAG, there was no check for the case where bmp-dbnumag is greater than or equal to MAXAG due to a corrupted image, which could lead to an out-of-bounds...

Astra Linux – Vulnerability in Linux 5.15

A issue was discovered in the Linux kernel before version 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, resulting in an out-of-bounds read in the ntfssetea function in fs/ntfs3/xattr.c...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: btrfs: The abort logic in btrfsreplacefileextents has been fixed. Error injection testing uncovered a case where a corrupt file system could occur, with an missing extent in the middle of a file. This occurs because the if...

Astra Linux – Vulnerability in openjpeg2

A flaw was discovered in OpenJPEG’s encoder, specifically in the opjdwtcalcexplicitstepsizes function. This flaw allows an attacker who can provide crafted inputs for the decomposition levels to cause a buffer overflow. The greatest threat of this vulnerability is to system availability...

Astra Linux – Vulnerability in Chromium

Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Incomplete cleanup in the Network component of Google Chrome prior to 152.0.7977.82 allowed a remote attacker to bypass system access restrictions through crafted network traffic. Chromium security severity: High...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: jfs: Check whether leafidx is greater than the number of leaves per dmap tree. syzbot reported an out-of-bounds error in dbSplit. This occurs when dmtleafidx is greater than the number of leaves per dmap tree. A check for...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: Fixed a slab-use-after-free issue caused by a dangling pointer dqipriv. When mounting ocfs2 and then remounting it as read-only, a slab-use-after-free occurs after the user uses the syscall to call ocfs2getnextid...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fixed a system hang that occurred during resume with a Thunderbolt monitor. Why This issue arises when using a Thunderbolt monitor and performing suspend operations; the system may hang during resume. During the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: cifs: The xid leak in cifscopyfilerange has been fixed. If the file is used by swap, before returning -EOPNOTSUPP, the xid should be freed. Otherwise, the xid will be leaked...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: jfs: Truncating good inode pages when the hard link is 0 The value of the fileset for the inode copy from the disk by the reproducer is AGGRRESERVEDI. When the evict function is executed, its hard link number is 0, so its inode...