CVE-2006-6184

CVE-2006-6184 This is a python-based standalone exploit for CVE-2006-6184. This exploit triggers a stack-based buffer overflow in Allied Telesyn TFTP Server AT-TFTP 1.9, and possibly earlier, allowing remote attackers to cause a denial of service or execute arbitrary code. Quick Start 0. let...

iCULeak.py

iCULeak.py Tool to find and extract credentials from phone configuration files in environments managed by Cisco's CUCM Call Manager. When using Cisco's CUCM Call Manager, phone configuration files are stored on a TFTP server. These VoIP phone configuration files quite frequently contain sensitive...

cve-2006-6184

CVE-2006-6184 This is a python-based standalone exploit for CVE-2006-6184. This exploit triggers a stack-based buffer overflow in Allied Telesyn TFTP Server AT-TFTP 1.9, and possibly earlier, allowing remote attackers to cause a denial of service or execute arbitrary code. Instructions Updated fo...

TFTPlunder

TFTPlunder: an exploit for CVE-2023-29930 This is an exploit script for a blind file read / write vulnerability in the Genesys formerly InIn TFTP provisioning server. Vulnerability info This vulnerability is due to unrestricted configuration options for the TFTP root path and file extensions. In...

Oracle Linux 8 : tftp (ELSA-2026-78952)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-78952 advisory. 5.2-28 - fix buffer overflow in remap genmatchstring with inverse rules CVE-2026-85234 RHEL-260620 Tenable has extracted the preceding description block direct...

USN-8901-1 erlang vulnerabilities

Wander Nauta discovered that Erlang incorrectly handled absolute paths when extracting zip archives. An attacker could possibly use this issue to write arbitrary files outside of the intended directory. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. CVE-2025-47...

Astra Linux – Vulnerability in libssh

In libssh 0.9.4, there is a NULL pointer dereferencing in tftpserver.c if sshbuffernew returns NULL...

CVE-2026-102713

The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes nxdtftpserver.c:1037 and nothing anywhere checks an upper bound, in particular not against the protocol maximum of 4 + NXTFTPFILETRANSFERMAX. Two things follow from that one missing check...

CVE-2026-102721

A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram. Each receive path checks only that the datagram is at least four bytes long nxdtftpclient.c:1229, 1521, 1984. When the opcode is NXTFTPCODEERROR the message string is copied with ...

CVE-2026-102721

The NetX Duo TFTP client is vulnerable to a heap-buffer-overflow in the nxd_tftp_client.c component. When a remote TFTP server returns an ERROR packet lacking a terminating NUL byte, the client fails to verify the buffer_ptr against the nx_packet_append_ptr during message copying. This causes the...

CVE-2026-102713

The NetX Duo TFTP server is vulnerable to a heap-buffer overflow and a denial-of-service condition due to a missing upper-bound check on incoming DATA datagrams . Because the server fails to validate that nx_packet_length is within the protocol maximum of 4 + NX_TFTP_FILE_TRANSFER_MAX, it allows ...

CVE-2026-102713

The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes nxdtftpserver.c:1037 and nothing anywhere checks an upper bound, in particular not against the protocol maximum of 4 + NXTFTPFILETRANSFERMAX. Two things follow from that one missing check...

CVE-2026-102713

The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes nxdtftpserver.c:1037 and nothing anywhere checks an upper bound, in particular not against the protocol maximum of 4 + NXTFTPFILETRANSFERMAX. Two things follow from that one missing check...

EUVD-2026-89176

The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes nxdtftpserver.c:1037 and nothing anywhere checks an upper bound, in particular not against the protocol maximum of 4 + NXTFTPFILETRANSFERMAX. Two things follow from that one missing check...

CVE-2026-102713

The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes nxdtftpserver.c:1037 and nothing anywhere checks an upper bound, in particular not against the protocol maximum of 4 + NXTFTPFILETRANSFERMAX. Two things follow from that one missing check...

PT-2026-102761

Name of the Vulnerable Software and Affected Versions NetX Duo TFTP server affected versions not specified Description The TFTP server fails to validate the upper bound of DATA datagram sizes, ignoring the protocol maximum of 4 + NX TFTP FILE TRANSFER MAX. This lack of validation leads to two...

CVE-2026-102721: Out-of-bounds Read

A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram. Each receive path checks only that the datagram is at least four bytes long nxdtftpclient.c:1229, 1521, 1984. When the opcode is NXTFTPCODEERROR the message string is copied with ...

CVE-2026-102713: Out-of-bounds Read

The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes nxdtftpserver.c:1037 and nothing anywhere checks an upper bound, in particular not against the protocol maximum of 4 + NXTFTPFILETRANSFERMAX. Two things follow from that one missing check...

TFTP Server Code Execution

The vulnerability of the TFTP server of the Windows Deployment Services service in Windows operating systems is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

Microsoft Patch Tuesday for August 2026 — Snort rules and prominent vulnerabilities

Microsoft has released its monthly security update for August 2026, which includes 421 vulnerabilities affecting a range of products, including 62 that Microsoft marked as "critical." Microsoft notes that 1 of the vulnerabilities disclosed this month have been exploited in the wild CVE-2026-68820...