CVE-2026-43284-DirtyFrag-PoC

CVE-2026-43284 — 4바이트 XFRM/ESP 개념 증명 PoC — XFRM/ESP 페이지 캐시 손상을 통한 로컬 권한 상승 4바이트 쓰기 프리미티브 · 48회 반복 · 192바이트 ELF 덮어쓰기 · 권한 없는 사용자 + netns 개념 증명 왼쪽: 커널 사전 점검, setuid 스캔 및 익스플로잇 체인 · 오른쪽: 루트 셸 실행 — id / whoami가 uid=0root 확인 테스트 환경: WSL2 · Ubuntu 24.04.1 LTS · 커널 6.6.87.2-microsoft-standard-WSL2...

EUVD-2026-92274

A security flaw has been discovered in vgmstream up to r2117. This affects the function parseparams/txtpparse of the file src/meta/txtpparser.c of the component TXTP File Handler. The manipulation results in out-of-bounds write. The attack may be launched remotely. The patch is identified as...

CVE-2026-105248 vgmstream TXTP File txtp_parser.c txtp_parse out-of-bounds write

A security flaw has been discovered in vgmstream up to r2117. This affects the function parseparams/txtpparse of the file src/meta/txtpparser.c of the component TXTP File Handler. The manipulation results in out-of-bounds write. The attack may be launched remotely. The patch is identified as...

CVE-2026-105248 vgmstream TXTP File txtp_parser.c txtp_parse out-of-bounds write

A security flaw has been discovered in vgmstream up to r2117. This affects the function parseparams/txtpparse of the file src/meta/txtpparser.c of the component TXTP File Handler. The manipulation results in out-of-bounds write. The attack may be launched remotely. The patch is identified as...

CVE-2026-105248

A security flaw exists in vgmstream up to version r2117 within the TXTP File Handler component. Specifically, the parse_params/txtp_parse function in the file src/meta/txtp_parser.c is vulnerable to an out-of-bounds write caused by malicious manipulation. This vulnerability may be exploited remot...

CVE-2026-105248 vgmstream TXTP File txtp_parser.c txtp_parse out-of-bounds write

A security flaw has been discovered in vgmstream up to r2117. This affects the function parseparams/txtpparse of the file src/meta/txtpparser.c of the component TXTP File Handler. The manipulation results in out-of-bounds write. The attack may be launched remotely. The patch is identified as...

CVE-2026-21045_and_CVE-2026-21048

CVE-2026-21045 & CVE-2026-21048 — Samsung libimagecodec.quram.so OOB書き込みPoC 概要 このリポジトリには、Samsung Androidデバイスで使用されるQuramsoftイメージコーデックライブラリ libimagecodec.quram.so における境界外 OOB 書き込みの脆弱性を示す概念的なProof-of-Concept PoC ファイルが含まれています。 CVE| 形式| タイプ| 重大度| CVSS 4.0| パッチ適用リリース ---|---|---|---|---|---...

cve-2024-32002-submodule-aw

CVE-2024-32002 서브모듈 AW CVE-2024-32002를 시연하기 위한 서브모듈입니다. .git에 임의 쓰기를 시연합니다. 이 리포지토리를 사용하는 작동하는 POC는 cve-2024-32002-poc-aw를 참조하십시오. 이 리포지토리에 포함된 내용 단순히, 부모 POC 리포지토리를 클론할 때 이를 감지할 수 있는 임의의 파일입니다. 파일 이름은 Problems입니다. .git에서 이 파일을 보면 문제가 있기 때문입니다...

CVE-2025-63602

CVE-2025-63602 CVE-2025-63602에 대한 공개 사항으로, Awesome Miner 11.2.4에서 안전하지 않은 드라이버를 사용하여 MSR에 대한 임의 커널 읽기/쓰기를 유발하고, 최종적으로 커널 코드 실행으로 이어지는 PoC를 포함합니다...

CVE-2026-36227

CVE-2026-36227: Easy Chat Server 3.1 UserName 경로 탐색 PoC 이 저장소는 Easy Chat Server 3.1 사용자 등록 처리에서 발생하는 경로 탐색 문제인 CVE-2026-36227에 대한 무해한 개념 증명을 포함합니다. 이 저장소는 승인된 보안 연구 및 로컬 재현 전용입니다. 소유하지 않았거나 명시적 테스트 권한이 없는 시스템에 사용하지 마십시오. 요약 Easy Chat Server 3.1은 POST /registresult.htm을 통해 등록 데이터를 수락합니다. UserName...

CVE-2026-43284

Dirty Frag: 유니버설 리눅스 LPE 개요 이 문서는 Hyunwoo Kim @v4bel이 발견하고 보고한 Dirty Frag 취약점 클래스에 대해 설명합니다. xfrm-ESP Page-Cache Write CVE-2026-43284와 RxRPC Page-Cache Write CVE-2026-43500을 체이닝하여 공격자는 주요 리눅스 배포판에서 루트로 권한을 상승시킬 수 있습니다. Dirty Frag는 Dirty Pipe 및 Copy Fail과 동일한 버그 계열에 속합니다. 이는 타이밍 윈도우나 경쟁 조건에 의존하지 않...

CVE-2026-6815

CVE-2026-6815 PoC/Exploit: Casdoor 3.54.1 パストラバーサルおよび任意ファイル書き込み（認証済み） このリポジトリは、Casdoor における任意ファイル書き込みおよびパストラバーサルの脆弱性 CVE-2026-6815 の Proof of Concept PoC エクスプロイトです。 この脆弱性はバージョン 3.54.1 で 修正 されました。 Requirements 攻撃者は、Casdoor インスタンスに対して管理者権限、またはストレージプロバイダを作成・編集できる同等のユーザーとして認証されている必要があります。 Impact...

mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing

A flaw was found in modauthopenidc, an OpenID Connect Relying Party module for Apache HTTP servers. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request with a malformed state cookie. This can lead to an out-of-bounds read and a one-byte out-of-bounds write...

gimp: gimp: out-of-bounds write in GIMPressionist plugin via crafted preset file

A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to...

Important: Red Hat Security Advisory: gimp security update

An update for gimp is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicio...

CVE-2026-20589

In venc, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9606...

CVE-2026-20579

In vdec, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9800...

CVE-2026-20544

In meta, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS110495...

CVE-2026-20586

In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9614...