MENU

Resources(82)

  • GDCM buffer overflow in ImageRegionReader :: ReadIntoBuffer

    Stelios Tsampas

    A flaw in GDCM versions before 2.6.2 allows an integer overflow in the ImageRegionReader::ReadIntoBuffer function, causing a buffer overflow that attackers can trigger using specially crafted DICOM image dimensions. Because the overflow bypasses internal size checks, it can lead to memory corruption, denial of...

  • Oracle WebCenter information exposure vulnerability

    CENSUS

    An information exposure flaw in Oracle WebCenter (Fusion Middleware 11.1.1.7 and 11.1.1.8) allows an unauthenticated attacker to access user profile data — including usernames, emails, phone numbers, and files — by abusing a default WebCenter account. Tracked as CVE‑2014‑0450, the issue enables full enumeration of...

  • Netvolution referer header SQL injection vulnerability

    CENSUS

    A blind SQL injection flaw in Netvolution v2.5.8 (ASP) allows attackers to inject arbitrary SQL commands through the HTTP Referer header. Because the CMS fails to sanitize this header, an unauthenticated attacker can extract database contents, modify site data, inject malicious JavaScript, harvest CMS usernames and...

  • Monkey HTTPd improper input validation vulnerability

    Patroklos Argyroudis

    A flaw in Monkey HTTPd versions 0.9.2 and earlier allows remote attackers to crash worker threads by sending HTTP requests with malformed Connection headers. Due to improper input validation and incorrect buffer‑end calculations in Request_Find_Variable(), certain crafted request bodies trigger signedness and...

  • CoreHTTP web server off-by-one buffer overflow vulnerability

    Patroklos Argyroudis

    A flaw in the CoreHTTP web server (versions 0.5.3.1 and earlier) allows remote attackers to trigger an off‑by‑one stack buffer overflow during parsing of malformed HTTP method names or URIs. Because the server's sscanf() call writes a full 256 bytes into 256‑byte buffers without ensuring NULL‑termination, crafted...

  • Linux kernel SUNRPC off-by-two buffer overflow

    Patroklos Argyroudis

    An off‑by‑two stack buffer overflow in the Linux SUNRPC subsystem (kernel versions 2.6.32 through 2.6.32‑rc7) allows out‑of‑bounds writes in the function rpc_uaddr2sockaddr() when processing universal address strings of maximum length. Because the function writes two bytes past the end of a fixed‑size stack buffer, a...

  • gif2png command line buffer overflow

    Patroklos Argyroudis

    A stack‑based buffer overflow in gif2png (versions 2.5.1 and earlier) allows attackers to overwrite memory by supplying an overly long filename on the command line. Because the program uses an unsafe strcpy() into a fixed‑size buffer, crafted input can cause a crash or potentially enable remote code execution when...

  • CVE-2008-3531: FreeBSD kernel stack overflow exploit development

    Patroklos Argyroudis

    About four months ago I developed a reliable exploit for vulnerability CVE-2008-3531, which is also addressed in the advisory FreeBSD-SA-08:08.nmount. In this post I will use this vulnerability to provide an overview of the development process for FreeBSD kernel stack exploits.

  • Rasterbar libtorrent arbitrary file overwrite vulnerability

    CENSUS

    A path‑sanitization flaw in Rasterbar libtorrent (versions 0.14.3 and earlier) allows attackers to craft malicious multi‑file .torrent metadata that includes directory components containing embedded relative paths (e.g., "../../"). Because libtorrent only checks for exact ".." matches, these malformed elements bypass...