CVE-2025-10230

CVE-2025-10230 — Samba WINS Hook Befehlsinjektion Der Autor übernimmt keine Haftung für Missbrauch oder Schäden, die durch dieses Tool verursacht werden. Die Forschung dient ausschließlich Bildungs- und Verteidigungszwecken. Beschreibung Dieses Repository enthält einen Proof-of-Concept PoC für...

CVE-2025-10230

CVE-2025-10230 PoC für CVE-2025-10230 - Samba WINS-Hook-Befehlsinjektion Die für diese Schwachstelle erforderliche Konfiguration betrifft wahrscheinlich 0 Personen. Die Injektion ist auf 15 Zeichen begrenzt und muss ein gültiger WINS-Name sein, daher kein ;...

CVE-2025-10230

CVE-2025-10230: Samba Critical RCE CVSS 10.0 Zusammenfassung der Schwachstelle CVE-2025-10230 ist eine kritische Schwachstelle zur Remote-Codeausführung RCE, die 13 Jahre lang im Code von Samba verborgen blieb. Der Fehler liegt in der Verarbeitung von WINS-Registrierungspaketen Windows Internet...

...[ More ]

A proof of concept exploit for an authorization bypass vulnerability in Traefik version 3.7.9. The vulnerability affects the Kubernetes Gateway API provider and results from ambiguous dynamic configuration object identifiers constructed by joining namespace and object names with hyphens. Differen...

openSUSE 16: ctdb / ctdb-pcp-pmda / ldb-tools / libldb-devel / libldb2 / etc (openSUSE-SU-2026:21540-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21540-1 advisory. Update to 4.22.11. Security issues fixed: - CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify...

OPENSUSE-SU-2026:21540-1 Security update for samba

This update for samba fixes the following issues: Update to 4.22.11. Security issues fixed: - CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the user.SmbReparse xattr bsc1261188. - CVE-2026-2340: WORM vfs module does not block directory...

PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks

Summary JWSVerifier::getAlgorithm in src/Library/Signature/JWSVerifier.php line 144 merges protected and unprotected headers using PHP's spread operator: php $completeHeader = ...$signature-getProtectedHeader, ...$signature-getHeader; In PHP, when spreading arrays with duplicate string keys, the...

USN-8306-2 samba vulnerabilities

USN-8306-1 fixed vulnerabilities in Samba. This update provides the corresponding updates for CVE-2026-3238, CVE-2026-4408, and CVE-2026-4480 in Ubuntu 20.04 LTS. Original advisory details: Asim Viladi Oglu Manizada discovered that Samba incorrectly handled access checks on reparse point...

ALPINE-CVE-2026-3238

A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the...

CVE-2026-3238

A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the...

CVE-2026-3238 Samba: denial of service against ad dc wins server

A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the...

CVE-2026-3238

A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the...

CVE-2026-3238

CVE-2026-3238 affects Samba’s WINS server in AD DCs, where unauthenticated UDP packets can trigger a NULL pointer dereference and crash the WINS service. Public details confirm the issue is a denial of service vector; no exploit details are provided in the documents. Remediation publicly document...

CVE-2026-3238 Samba: denial of service against ad dc wins server

A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the...

OESA-2026-2577 samba security update

Samba is a suite of programs for Linux and Unix to interoperate with Windows. Security Fixes: '-------- Forwarded Message --------', 'Date: Tue, 26 May 2026 14:29:50 +0200', 'Reply-To: Stefan Metzmacher metze samba org', 'Release Announcements\n---------------------\n\nThis is a security release ...

The vulnerability of the WINS-server software Samba, which allows a hacker to trigger a service failure

The vulnerability of the WINS-server software Samba is related to pointer aliasing. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Samba vulnerabilities (USN-8306-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8306-1 advisory. Asim Viladi Oglu Manizada discovered that Samba incorrectly handled access checks on reparse point operations. An attacke...

USN-8306-1: Samba vulnerabilities

Asim Viladi Oglu Manizada discovered that Samba incorrectly handled access checks on reparse point operations. An attacker could possibly use this issue to modify reparse point extended attributes on files that should have been read-only. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS...

CVE-2026-3238

A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the...

PT-2026-43439

Name of the Vulnerable Software and Affected Versions ctdb versions prior to 4.23.8+git.477.f78166bceed-1.1 Description A denial of service issue exists against the AD DC WINS server. Recommendations Update to version 4.23.8+git.477.f78166bceed-1.1...