CVE and Zero-Day General - Because there's so many at this rate there may as well be a general thread for it

  • Want to keep track of this thread?
    Accounts can bookmark posts, watch threads for updates, and jump back to where you stopped reading.
    Create account
You can't have 0days, if there is nobody to keep track of them.

:cunningpepe:
On a more cynical note, i know that the CVE database is just kept stocked by useful idiots and idealists.
Almost every "Security researcher" knows that a good RCE is worth money which in turn is worth more than a mention in some hall of fame page.
 
Last edited:
HahaYes said:
Pretty big news, the MITRE foundations support for the CVE program is set to expire today:
MITRE’s Support for CVE Program Set to Expire | Archive
Click to expand...
And at the end CISA extended for another 11 months
X / Archive
media.webp
 
Crosspost:
WhiteNight said:
A major security flaw in Git just dropped. Arbitrary code can be run on your machine when you clone a repo.

Minimal example illustrating it is here:

Distros are scrambling to get ahead of this, or at least not too far behind it.

ETA:
Hacker News discussion: https://news.ycombinator.com/item?id=44502330
Debian bug (severity grave): https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108983
Homebrew PR: https://github.com/Homebrew/homebrew-core/pull/229423 (merged already)
NixOS PR: https://github.com/NixOS/nixpkgs/pull/423553 (merged)
Alpine MR: https://gitlab.alpinelinux.org/alpine/aports/-/merge_requests/86835 (merged)
Click to expand...
 
Markass the Worst said:
Crosspost:
Click to expand...
Should've used mercurial, pijul or Fossil, but who am I kidding, two use Rust and another uses SQL.
DARCS ftw
Thread tax. I'm suprised there's not more word about this.


Published: 2025-07-08
Updated: 2025-07-08
Title: SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability
Description:Heap-based buffer overflow in Windows SPNEGO Extended Negotiation allows an unauthorized attacker to execute code over a network.

9.8CRITICAL3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Click to expand...

Mitigations​


The following mitigating factors might be helpful in your situation:

This vulnerability affects Windows client machines running Windows 10, version 1607 and above, due to the following GPO being enabled by default on these operating systems: "Network security: Allow PKU2U authentication requests to this computer to use online identities".

How could an attacker exploit the vulnerability?

An attacker could exploit this vulnerability by sending a malicious message to the server, potentially leading to remote code execution.
What is SPNEGO Extended Negotiation?

The SPNEGO Extended Negotiation Security Mechanism (NEGOEX) extends Simple and Protected GSS-API Negotiation Mechanism (SPNEGO) described in [RFC4178].
Click to expand...
 
Spectre/Meltdown v2? All Zen chips affected.

Code: 
CVE-2024-363505.6 (Medium) AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:NA transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information.

CVE-2024-363575.6 (Medium) AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:NA transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.

CVE-2024-363483.8 (Low) AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:NA transient execution vulnerability in some AMD processors may allow a user process to infer the control registers speculatively even if UMIP[3] feature is enabled, potentially resulting in information leakage.

CVE-2024-363493.8 (Low) AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:NA transient execution vulnerability in some AMD processors may allow a user process to infer TSC_AUX even when such a read is disabled, potentially resulting in information leakage.
 

Attachments

I nominate this bug for the glownigger of the year award.
Belkin pulled the age old "whoops we forgot to remove hardcoded passwords" and may not have changed it for all these years CVE-2025-8730 (CVSS 8.9). This is a router from 2015.
A vulnerability was found in Belkin F9K1009 and F9K1010 2.00.04/2.00.09 and classified as critical. Affected by this issue is some unknown functionality of the component Web Interface. The manipulation leads to hard-coded credentials. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Click to expand...
CIA NIGGERS!​

Ouch :CVE-2023-5388 (CVSS 6.5) Good job gentoo being a year late per the usual by skipping the 3.9x versionf of NSS.
Here's the OpenSSL bug.
I've been working on testing against timing attacks using tlsfuzzer, the newest version of that code is in the upstream pregenerate branch[1].

What's special about it, is that it is much more sensitive to timing side-channels than both my previous attempts at it, from bug 1651411, and what the published research suggests. In particular, I'm able to detect the OpenSSL side-channel caused by the https://github.com/openssl/openssl/issues/6640 bug in just 10 thousand connections with 2048 bit RSA keys, over local gigabit Ethernet: the measured side channel is about 55ns while the test provides a result with a 95% confidence interval of ±36ns.

I haven't executed extensive tests against NSS, so I don't have good results with NSS just yet, but I've talked with Bob about the NSS code and how it handles multi-precision integers. The problem is similar as the one in OpenSSL.

The MPI objects internally represent large integers as a list of word-sized (64bit or 32bit) integers. The problem is, that many operations on objects perform "clamping" (if the most significant word is zero, they drop it and store the number in fewer words), in particular, the modulo multiplication performing the unblinding after the modular exponentiation in RSA private key decryption.

The problem is that when such number then needs to be converted to a byte string, so that it can be fed into a hash function, or so that the padding can be checked (be it PKCS#1v1.5 or OAEP), that operation can't take the same amount of time, since it operates on different number of words used to represent the number. In other words, that conversion then leaks if the high order bytes are zero or not: precisely the signal necessary for Bleichenbacher oracle.

I'll add detailed test results later.

Please keep this issue embargoed as other implementations are vulnerable, so we'd prefer to release information about it in a coordinated fashion.
Click to expand...

Autodialersiallators will not poo in the loo saaaar CVE-2025-2611 (9.3 CVSS)
The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling.
Click to expand...
 
Last edited:
Darkholme's Dungeon said:
I nominate this bug for the glownigger of the year award.
Belkin pulled the age old "whoops we forgot to remove hardcoded passwords" and may not have changed it for all these years CVE-2025-8730 (CVSS 8.9). This is a router from 2015.
Click to expand...

First, fucking lol at using a Belkin router after this shit where they would randomly redirect your web request to an ad for their security software. You get what you fucking deserve, etc.

Second, it requires the web interface being accessible. If you are retarded enough to have your web interface accessible via external, I don't know what to tell you. And if you aren't using an isolated guest network for your porn web browswing... again "Peanut Butter. WARNING: May contain peanuts"

Third, lol not using a router with 3rd party open source firmware available. Just absolute fucking lol.
 
Plex has some sort of issue going on. No CVE yet
We recently received a report via our bug bounty program that there was a potential security issue affecting PMS versions 1.41.7.x to 1.42.0.x. Thanks to that user, we were able to address the issue and continue to improve our security and defenses.

We strongly recommend that everyone have their PMS updated to the most recent version as soon as possible, if you have not already done so.

The new version, 1.42.1, is now available to update through the PMS management page or you can download it here:
Click to expand...
 
Somewhat late, but still. Unity-related: CVE-2025-59489

"Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location"

That's a lot of video games and a lot of platforms.
 
Last edited:
Croak & Caw said:
Somewhat late, but still. Unity-related: CVE-2025-59489

"Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location"

That's a lot of video games and a lot of platforms.
Click to expand...
it looks like this is the kind of thing that could only be taken advantage of by third party tools that hook into unity. while thinking of what could possibly even fit that description - i am immediately reminded of the game Sulfur that runs on unity and its small modding community is entirely reliant on a mod loader that a chinese guy made and uploaded to github that is not open source and uses a bunch of provided DLL's to hook into the game.

which is basically the exact disclosed exploit chain here. hey, the developers said it's fine, what could possibly go wrong?
 
Notepad++ v8.8.6 had Don Ho complaining about a non-issue CVE in Notepad++. You know, the typical "if the attacker has full privileged access to the system they could do something bad" type of non-issue that's then paraded around as a sign that the software is compromised because it's a CVE.

Which made me think of a stupid joke. Given how a lot of these CVE's are basically non-issues in terms of practical security concerns that are put onto the CVE database by midwits for the sake of showing that they're a "security expert" on their resume becasuse those three letters have that "academic prestige" behind them, CVE's could be referred to as "Curriculum Vitae Expanders".
 
Title: Windows Notepad App Remote Code Execution Vulnerability
Score: 8.8/10

Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code over a network.

CVE link: https://www.cve.org/CVERecord?id=CVE-2026-20841
Published: 2026-02-10
Updated: 2026-02-11
Versions: affected from 11.0.0 before 11.2510

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Scope: Unchanged (runs as user)
Impact: High confidentiality, integrity and availability impact.

Summary: This is a remote, easy-to-trigger vulnerability requiring no login, but it does require a user action. If triggered, it can lead to major compromise (data theft + system modification + downtime).
 
Not a CVE or zero day strictly but dev loosing their mind and causing data destruction.
Darkholme's Dungeon

Post in thread 'Open Source Software Community'

Open source 3rd party telegram client (Nekogram) dev got mogged by the MSS spergs out about politics, made his software to be malware. Sends info back to owner and if he deems you are "associated with political content" he yeets your account.

Coder is some chinese neko gooner fag (telegram) he goes by "Cat ear (power) inverter"
Can some archive... Sorry it autofails my captcha check...
573482393-00ca182b-a3f1-43c7-8f62-d431fa3c39ec.png
His email btw: chsqwyx@gmail.com
Translation:
Cat ear (power) inverter: "In the new version I...
Click to expand...
Reactions:Informative x 6 Lunacy x 12 Horrifying x 1
 
Now is a good time to install Linux kernel patches. There is a root exploit affecting most kernels commonly used by Linux distributions since 2017. Check out https://copy.fail for exploit details.

CVE link: https://www.cve.org/CVERecord?id=CVE-2026-31431

Vendor: Linux
Product: Linux
Versions: 10 Total
Default Status: affected

affected
  • affected at 4.14
unaffected
  • unaffected from 0 before 4.14
  • unaffected from 5.10.254 through 5.10.*
  • unaffected from 5.15.204 through 5.15.*
  • unaffected from 6.1.170 through 6.1.*
  • unaffected from 6.6.137 through 6.6.*
  • unaffected from 6.12.85 through 6.12.*
  • unaffected from 6.18.22 through 6.18.*
  • unaffected from 6.19.12 through 6.19.*
  • unaffected from 7.0
 
You must log in or register to reply here.
Back
Top Bottom