1863 matches found
CVE-2004-0558
这是针对CVE-2004-0558的概念验证利用程序 特定版本的CUPs（1.1.x）在接收到零长度UDP数据包时存在拒绝服务漏洞 https://www.exploit-db.com/exploits/24599/ 值得注意的是，使用nmap也可以实现此攻击，该利用程序仅用于研究和教育目的。 用法： python kill-cups.py -t 192.168.1.91 附加的命令行标志仅用于研究目的。UDP要求数据包头部使用任意源端口。在利用程序中，我默认将其设置为4321，但如有必要可以更改。 python kill-cups.py -t 192.168.1.91...
CVE-2026-40369
这是对 VoidSec 公开技术分析 CVE-2026-40369 的改写和总结，添加了流程图和防御笔记，以便我自己理解。 所有核心技术细节均来自他的研究。我并未对此漏洞进行独立的逆向工程。 CVE-2026-40369：关于 12 字节 Windows 内核递增加载原语的防御分析 一项关于 CVE-2026-40369 的防御性技术分析，这是一个 Windows 内核权限提升漏洞，通过 NtQuerySystemInformation（信息类 0xFD / 253）提供了一个受限的 12 字节加法写入原语。 本报告重点关注利用约束条件、根本原因分析和防御影响，而非武器化利用。 概述...
Rocky Linux 10.0 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2025_16904)
The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202516904 advisory. kernel: fs: export anoninodemakesecureinode and fix secretmem LSM bypass CVE-2025-38396 kernel: smb: client: fix use-after-free in cifsoplockbreak...
Rocky Linux 9.6 [TuxCare] Security Update: nmap / nmap-ncat (ALMALINUX9.6:CLSA-2026:1789630245)
The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789630245 advisory. - Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application b...
SUSE CVE-2026-97546
In the Linux kernel, the following vulnerability has been resolved: xfs: don't spin forever on zero-length dirents when salvaging them LOLLM noticed that xrepdirrecoverdata can spin forever if it encounters an unused dirent that claims to have length zero. Fix that, and prevent the same thing fro...
cve-2025-39682
CVE-2025-39682 在 kernelCTF 缓解实例上的利用 这也是我的第一个（？我不确定，这是 CVE-2024-58239 的一个变种）1-day 利用。 Patch: tls: 修复 rxlist 上零长度记录的处理 这个 CVE 被用于 exp398 和 exp403。 kernelCTF 电子表格。 关于文件夹结构和如何运行该利用，请参考我的 CVE-2024-58239 仓库。 我稍微修改了我之前的利用。它在同一个 mitigation-v4-6.6 实例上有效，并且成功率更高。 成功率：79/100。 在 kernelCTF 实例上运行：...
CVE-2025-39682
CVE-2025-39682 — Linux kTLS 零长度 rxlist 记录 UAF 跟踪站点 CVE-2025-39682 补丁状态跟踪器的源码：一个单页站点， 记录哪些发行版已发布针对 Linux 内核 kTLS 接收路径（net/tls）中 use-after-free 漏洞的修复。 事实所在之处 关于该漏洞的一切——CVE 编号、受影响及已修复版本、上游修复提交、 发现与披露致谢，以及当前各发行版的补丁状态——都属于跟踪器页面， 而非本 README： 渲染页面： https://kimmo.cloud/CVE-2025-39682/ 源码：...
eero-zero-length-ipv6-options-header-dos
eeroOS: Vulnerabilidad de denegación de servicio en la interfaz Ethernet CVE-2023-5324 ========================================================================= Si los dispositivos eero Pro 5 reciben un paquete IPv6 cuya longitud de carga útil es cero y que contiene una cabecera de extensión de...
UBUNTU-CVE-2026-98145
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is zero passes the payload length check, because structsizepayload, data, 0 is just the header. The fill loop then does not run, so offset...
CVE-2026-98145
The Linux kernel contains a vulnerability in the accel/amdxdna driver where a command chain with a command_count of zero improperly passes payload length checks. Because the struct_size calculation only accounts for the header, the fill loop is skipped, resulting in the submission of a zero-lengt...
CVE-2026-98145 accel/amdxdna: reject a command chain that carries no commands
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is zero passes the payload length check, because structsizepayload, data, 0 is just the header. The fill loop then does not run, so offset...
CVE-2026-97546 xfs: don't spin forever on zero-length dirents when salvaging them
In the Linux kernel, the following vulnerability has been resolved: xfs: don't spin forever on zero-length dirents when salvaging them LOLLM noticed that xrepdirrecoverdata can spin forever if it encounters an unused dirent that claims to have length zero. Fix that, and prevent the same thing fro...
CVE-2026-97546
In the Linux kernel, the following vulnerability has been resolved: xfs: don't spin forever on zero-length dirents when salvaging them LOLLM noticed that xrepdirrecoverdata can spin forever if it encounters an unused dirent that claims to have length zero. Fix that, and prevent the same thing fro...
CVE-2026-97546
In the Linux kernel, the following vulnerability has been resolved: xfs: don't spin forever on zero-length dirents when salvaging them LOLLM noticed that xrepdirrecoverdata can spin forever if it encounters an unused dirent that claims to have length zero. Fix that, and prevent the same thing fro...
CVE-2026-98145: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is zero passes the payload length check, because structsizepayload, data, 0 is just the header. The fill loop then does not run, so offset...
CVE-2026-97546: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: xfs: don't spin forever on zero-length dirents when salvaging them LOLLM noticed that xrepdirrecoverdata can spin forever if it encounters an unused dirent that claims to have length zero. Fix that, and prevent the same thing fro...
Updated nmap packages fix a security vulnerability
Denial of Service via Zero-Length TCP Option Packet. CVE-2026-72712...
Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rxlist to bypass the intended recvmsg record-type handling, potentially causing subsequent TLS records to be processed using...
VulnCheck KEV: CVE-2025-39682
Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rxlist to bypass the intended recvmsg record-type handling, potentially causing subsequent TLS records to be processed using...
CVE-2026-93395
A missing lower-bound validation in the bsonnewfrombuffer function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 the minimum valid BSON...