flow_divert-heap-overflow

flowdivert-heap-overflow flowdivert-heap-overflow는 CVE-2016-1827에 대한 개념 증명 익스플로잇으로, OS X El Capitan 10.11.5 및 iOS 9.3.2에서 패치되었습니다. 이 취약점은 flowdiverthandleappmapcreate 함수에서 사용자 공간으로부터 제공된 신뢰할 수 없는 길이 값에 대해 검사되지 않은 일련의 산술 연산이 수행되는 문제입니다. 익스플로잇에는 루트 권한이 필요합니다. 이 개념 증명은 OS X Yosemite 10.10.5에서 커널 패닉을...

sysctl_coalition_get_pid_list-dos

sysctlcoalitiongetpidlist-dos bsd/kern/syscoalition.c 内の sysctlcoalitiongetpidlist 関数は、coalitiongetpidlist 関数を使用してコアリション内の PID のリストを収集します。この関数は、成功した場合は PID の数を返し、失敗した場合は負の errno を返します。しかし、sysctlcoalitiongetpidlist 関数はエラー条件を適切にチェックしておらず、負の数の PID を SYSCTLOUT 経由でユーザ空間に送信しようとします。length パラメータは sizet...

CVE-2017-14980

🐞 CVE-2017-14980: Sync Breeze Enterprise 10.0.28 - 스택 기반 버퍼 오버플로우 /login 핸들러를 통해 접근 가능한 Sync Breeze Enterprise 10.0.28의 스택 기반 버퍼 오버플로우입니다. 입력 길이 검사가 없을 경우 스택 메모리가 어떻게 손상될 수 있는지 보여줍니다. 📑 목차 이 저장소가 존재하는 이유 이 취약점이 흥미로운 이유 컨텍스트 및 영향을 받는 소프트웨어 취약점 정보 크래시 유발 익스플로잇 🎓 이 저장소가 존재하는 이유 이 저장소는 제가 메모리 손상 익스플로...

Linux Distros Unpatched Vulnerability : CVE-2026-90406

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: qcom: iris: handle runtime PM resume failure in core deinit Check the return value of pmruntimeresumeandget in iriscoredeinit. If runtime PM resume fails...

CVE-2026-73638

Imager versions from 0.4502 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiffloadifd. tiffloadifd validates an IFD entry's data by checking that entry-offset + entry-size stays within the EXIF block, and never checks the start offset itself. Where that sum is n...

CVE-2026-90324 ublk: check import_ubuf() return value

In the Linux kernel, the following vulnerability has been resolved: ublk: check importubuf return value importubuf can fail if the address range provided by the userspace ublk server is outside the allowed user address space. Return that 0 bytes were copied if importubuf fails rather than passing...

cve-2026-25994_PJSIP

CVE-2026-25994 – PJNATH ICE 스택 버퍼 오버플로pjsip ≤ 2.16 개요 CVE-2026-25994는 pjsip ≤ 2.16의 ICEInteractive Connectivity Establishment 구현, 특히 PJNATH 구성 요소에 영향을 미치는 스택 기반 버퍼 오버플로 취약점입니다. 취약점은 다음 함수에 존재합니다: pjicesesscreatechecklist 다음 위치에 있습니다: pjnath/src/pjnath/icesession.c 취약점 세부 정보 이 문제는 ICE 사용자 이름을 구성할 ...

CVE-2026-71180

Dell Update Package Framework, versions prior to 26.07.03, contains an Unchecked Return Value vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges...

EUVD-2026-80865

Dell Update Package Framework, versions prior to 26.07.03, contains an Unchecked Return Value vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-71180

Dell Update Package Framework versions prior to 26.07.03 are affected by an Unchecked Return Value vulnerability. A low-privileged attacker with local access can exploit this flaw, potentially achieving Elevation of Privileges . The CVSS 3.1 score is 8.2 (HIGH) with a changed scope and high impac...

CVE-2026-71180

Dell Update Package Framework, versions prior to 26.07.03, contains an Unchecked Return Value vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-89784

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: check rpcsockaddr2uaddr return value in rpcbregisterinet4/6 rpcbregisterinet4 and rpcbregisterinet6 store the result of rpcsockaddr2uaddr into map-raddr without checking it for NULL. rpcsockaddr2uaddr returns NULL when it...

CVE-2025-52099

CVE-2025-52099 SQLite 3.50.0 における整数オーバーフロー SQLite 3.50.0 の setupLookaside 関数で整数オーバーフローを引き起こす概念実証（PoC）を以下に示します。このオーバーフローは、sz nBig の乗算がチェックされずに発生し、負の値にラップして不正なメモリ書き込みを引き起こす可能性があります。 テスト環境: Ubuntu 22.04 x8664 + SQLite 3.50.0（カスタムビルド） PoC コード（C）: include include int main sqlite3 db; root@kitploit: //...

EUVD-2026-80037

Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in the QoS setter CGI handlers filterconndelcgi.c and grepriosetcgi.c due to unchecked atoi results. An attacker can trigger the flaw by supplying crafted input to these handlers, causing a denial of service...

CVE-2026-76865

Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in the QoS setter CGI handlers filterconndelcgi.c and grepriosetcgi.c due to unchecked atoi results. An attacker can trigger the flaw by supplying crafted input to these handlers, causing a denial of service...

CVE-2026-76865

Netcore NR255-V (version 1.5.130703) is affected by a null pointer dereference in its QoS setter CGI handlers, specifically filter_conn_del_cgi.c and gre_prio_set_cgi.c , caused by unchecked atoi() results. An attacker with high-level privileges can supply crafted input to these handlers to trigg...

CVE-2026-76865 Netcore NR255-V 1.5.130703 NULL Pointer Dereference via Unchecked atoi() in QoS Setter Handlers

Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in the QoS setter CGI handlers filterconndelcgi.c and grepriosetcgi.c due to unchecked atoi results. An attacker can trigger the flaw by supplying crafted input to these handlers, causing a denial of service...

Astra Linux – Vulnerability in libstb

stbimage is a single-file library licensed under MIT that is used for processing images. The stbigetn function reads a specified number of bytes from the context usually a file into the specified buffer. If the file stream points to the end of the file, it returns zero. There are two places where...

Astra Linux – Vulnerability in gst-plugins-good1.0

GStreamer is a library for constructing graphs of media-handling components. A OOB-read vulnerability has been discovered in the qtdemuxparsecontainer function within qtdemux.c. In the parent function qtdemuxparsenode, the value of length is not properly checked. As a result, if length is large...

Astra Linux – Vulnerability in libxml2

In libxml2 versions before 2.9.14, several buffer handling functions in buf.c xmlBuf and tree.c xmlBuffer do not check for integer overflows. This can lead to out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software that uses libxml2’s...