1181568 matches found
crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation
A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...
golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...
net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...
encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...
golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
Important: Red Hat Security Advisory: git-lfs security update
An update for git-lfs is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...
crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building
A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...
crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec
A flaw was found in the Golang crypto/internal/nistec package. Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Considering how this function is used, this leaka...
crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...
kernel: RDMA/rxe: Fix double free in rxe_srq_from_init
A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA subsystem, specifically within the rxe driver. An error in the rxesrqfrominit function's memory management can lead to a double free vulnerability. This occurs when an attempt to copy data to user space fails, causing the sam...
kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer
A use-after-free vulnerability was found in the Linux kernel's IPv6 FIB rule lookup path. In fib6rulesuppress, when a route is suppressed and released via ip6rtputflags, the res-rt6 pointer is not cleared. If no later rule supplies a replacement route, fib6rulelookup returns the stale freed rt6in...
webvm
WebVM This repository hosts the source code for https://webvm.io, a Linux virtual machine that runs in your browser. Try out the new Alpine / Xorg / i3 graphical environment: https://webvm.io/alpine.html What is WebVM? WebVM is a server-less virtual environment running fully client-side in...
EventLogin-CVE-2025-29969
EventLogin - CVE-2025-29969 EventLogin is a Time-of-check time-of-use vulnerability in the MS-EVEN protocol. The vulnerability enables low-privileged users to write arbitrary files to a remote machine, effectively bypassing the need for an Administrator account for a remote write. There are two...
BlackDir-Framework
BlackDir-Framework 1 Rastrear directorios 2 Encontrar subdominio 3 Búsqueda avanzada de dorks 4 Escanear lista de dorks 5 Escanear sitios web Xss,Sql,Html Inj 6 Búsqueda inversa de IP 7 Escaneo de puertos 8 Fuerza bruta a Wordpress 9 Enumerar usuarios de Wordpress 10 Cifrado hash...
easysploit
EasySploit EasySploit v4.2 Linux - Automatización de Metasploit MÁS FÁCIL y MÁS RÁPIDO que NUNCA Descargo de responsabilidad: El uso de EASYSPLOIT para atacar objetivos sin consentimiento mutuo previo es ILEGAL. Los desarrolladores no son responsables por ningún daño causado por este script...
krf
KRF KRF is a K ernelspace R andomized F aulter. It currently supports the Linux and FreeBSD kernels. What? Fault injection is a software testing technique that involves inducing failures "faults" in the functions called by a program. If the callee has failed to perform proper error checking and...
krf
KRF KRF is a K ernelspace R andomized F aulter. Actualmente soporta los núcleos Linux y FreeBSD. ¿Qué? La inyección de fallos es una técnica de prueba de software que implica inducir fallos "faults" en las funciones llamadas por un programa. Si la función llamada no ha realizado una comprobación ...
CVE-2026-9082-Drupal-PoC
CVE-2026-9082 - Drupal Core PostgreSQL SQL Injection PoC Overview This repository provides an ethical Proof-of-Concept PoC for CVE-2026-9082 , a Highly Critical SQL injection vulnerability in Drupal Core affecting all PostgreSQL-backed sites running Drupal 8.0 through 11.3.9. The flaw resides in...
cve-2020-11651
CVE-2020-11651 This is a POC for CVE-2020-11651, which obtains pre-auth RCE on a salt stack master, and/or all the associated minions. Some light details on the issue are here. POC for 2020-11652 not included. This obtains command execution on the master by creating a runner of salt.cmd with...