sysctl_coalition_get_pid_list-dos

sysctlcoalitiongetpidlist-dos La función sysctlcoalitiongetpidlist en bsd/kern/syscoalition.c utiliza la función coalitiongetpidlist para recopilar una lista de PIDs en una coalición. Esta función devolverá el número de PIDs si tiene éxito o un errno negativo en caso de fallo. Sin embargo, la...

flow_divert-heap-overflow

flowdivert-heap-overflow flowdivert-heap-overflow 是针对 CVE-2016-1827 的概念验证漏洞利用，该漏洞已在 OS X El Capitan 10.11.5 和 iOS 9.3.2 中修复。 该漏洞是函数 flowdiverthandleappmapcreate 中针对用户空间提供的不可信长度进行的一系列未检查算术运算。利用该漏洞需要 root 权限。 此概念验证会在 OS X Yosemite 10.10.5 上触发内核恐慌。在 El Capitan 中，长度字段已从 64 位改为 32...

CVE-2017-14980

🐞 CVE-2017-14980: Sync Breeze Enterprise 10.0.28 - 基于栈的缓冲区溢出 Sync Breeze Enterprise 10.0.28 中通过 /login 处理程序触发的基于栈的缓冲区溢出，展示了未检查的输入长度如何破坏栈内存。 📑 目录 为什么会有这个仓库 为什么这个漏洞有意思 背景与受影响软件 关于漏洞 触发崩溃 利用过程 🎓 为什么会有这个仓库 这个仓库是我在教授内存损坏利用时使用的材料的一部分（除了日常工作，我还在不同的网络安全课程中任教，帮助培养下一代逆向工程师）。 CVE-2017-14980 是我用来让学生体验通过...

Linux Distros Unpatched Vulnerability : CVE-2026-90406

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: qcom: iris: handle runtime PM resume failure in core deinit Check the return value of pmruntimeresumeandget in iriscoredeinit. If runtime PM resume fails...

Linux Distros Unpatched Vulnerability : CVE-2026-90331

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: asus: refactor the two workqueues and init sequence Multiple issues have been found within the hid- asus driver: - unchecked size in asusrawevent - unclean...

CVE-2026-73638

Imager versions from 0.4502 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiffloadifd. tiffloadifd validates an IFD entry's data by checking that entry-offset + entry-size stays within the EXIF block, and never checks the start offset itself. Where that sum is n...

CVE-2026-90324 ublk: check import_ubuf() return value

In the Linux kernel, the following vulnerability has been resolved: ublk: check importubuf return value importubuf can fail if the address range provided by the userspace ublk server is outside the allowed user address space. Return that 0 bytes were copied if importubuf fails rather than passing...

cve-2026-25994_PJSIP

CVE-2026-25994 – PJNATH ICE 栈缓冲区溢出 pjsip ≤ 2.16 概述 CVE-2026-25994 是一个基于栈的缓冲区溢出漏洞，影响 pjsip ≤ 2.16 中的 ICE（交互式连接建立）实现，具体位于 PJNATH 组件内。 该漏洞存在于以下函数中： pjicesesscreatechecklist 位于文件： pjnath/src/pjnath/icesession.c 漏洞详情 该问题由构造 ICE 用户名时的不安全字符串处理导致： root@kitploit: char buf128; // 固定大小的栈缓冲区 username.ptr =...

CVE-2026-71180

Dell Update Package Framework, versions prior to 26.07.03, contains an Unchecked Return Value vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges...

EUVD-2026-80865

Dell Update Package Framework, versions prior to 26.07.03, contains an Unchecked Return Value vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-71180

Dell Update Package Framework, versions prior to 26.07.03, contains an Unchecked Return Value vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-71180

Dell Update Package Framework versions prior to 26.07.03 are affected by an Unchecked Return Value vulnerability. A low-privileged attacker with local access can exploit this flaw, potentially achieving Elevation of Privileges . The CVSS 3.1 score is 8.2 (HIGH) with a changed scope and high impac...

CVE-2026-89784

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: check rpcsockaddr2uaddr return value in rpcbregisterinet4/6 rpcbregisterinet4 and rpcbregisterinet6 store the result of rpcsockaddr2uaddr into map-raddr without checking it for NULL. rpcsockaddr2uaddr returns NULL when it...

CVE-2025-52099

CVE-2025-52099 SQLite 3.50.0 中的一个整数溢出 下面提供了一个概念验证（PoC），用于触发 SQLite 3.50.0 的 setupLookaside 函数中的整数溢出。该溢出是由于 sz nBig 的乘法未经过检查而导致的，该乘法可能回绕为负值，并导致无效的内存写入。 测试环境：Ubuntu 22.04 x8664，SQLite 3.50.0（自定义构建） PoC 代码（C）： include include int main sqlite3 db; root@kitploit: // Open SQLite database if...

EUVD-2026-80037

Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in the QoS setter CGI handlers filterconndelcgi.c and grepriosetcgi.c due to unchecked atoi results. An attacker can trigger the flaw by supplying crafted input to these handlers, causing a denial of service...

CVE-2026-76865

Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in the QoS setter CGI handlers filterconndelcgi.c and grepriosetcgi.c due to unchecked atoi results. An attacker can trigger the flaw by supplying crafted input to these handlers, causing a denial of service...

CVE-2026-76865 Netcore NR255-V 1.5.130703 NULL Pointer Dereference via Unchecked atoi() in QoS Setter Handlers

Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in the QoS setter CGI handlers filterconndelcgi.c and grepriosetcgi.c due to unchecked atoi results. An attacker can trigger the flaw by supplying crafted input to these handlers, causing a denial of service...

CVE-2026-76865

Netcore NR255-V (version 1.5.130703) is affected by a null pointer dereference in its QoS setter CGI handlers, specifically filter_conn_del_cgi.c and gre_prio_set_cgi.c , caused by unchecked atoi() results. An attacker with high-level privileges can supply crafted input to these handlers to trigg...

CVE-2026-55093

Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs readtensor for attacker-controlled tensor dimensions, the allocation size, and the reported tensor length...

Astra Linux – Vulnerability in libstb

stbimage is a single-file library licensed under MIT that is used for processing images. The stbigetn function reads a specified number of bytes from the context usually a file into the specified buffer. If the file stream points to the end of the file, it returns zero. There are two places where...