exploitable – RabbitZ Academy – Next Gen Cybersecurity

Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

BlackRabbitZ — Sun, 31 May 2026 09:04:18 +0000

Information published.

Quelle: Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

BlackRabbitZ — Sun, 31 May 2026 09:04:17 +0000

Information published.

Quelle: Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

BlackRabbitZ — Sun, 31 May 2026 09:04:17 +0000

Information published.

Quelle: Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2025-15504 lief-project LIEF ELF Binary Parser.tcc parse_binary null pointer dereference

BlackRabbitZ — Sun, 31 May 2026 09:04:16 +0000

Information published.

Quelle: CVE-2025-15504 lief-project LIEF ELF Binary Parser.tcc parse_binary null pointer dereference

CVE-2024-36137 A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the –allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a „read-only“ file descriptor to change the owner and permissions of a file.

BlackRabbitZ — Sun, 31 May 2026 08:48:30 +0000

Information published.

Quelle:

CVE-2024-36137 A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the –allow-fs-write flag is used.

Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a „read-only“ file descriptor to change the owner and permissions of a file.

CVE-2024-22018 A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the –allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

BlackRabbitZ — Sun, 31 May 2026 08:34:40 +0000

Information published.

Quelle: CVE-2024-22018 A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the –allow-fs-read flag is used.
This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.
This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

CVE-2017-3736 There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. This only affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen.

BlackRabbitZ — Sun, 31 May 2026 08:18:06 +0000

Information published.

Quelle: CVE-2017-3736 There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. This only affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen.

CVE-2026-28387 Potential Use-after-free in DANE Client Code

BlackRabbitZ — Sun, 31 May 2026 08:18:05 +0000

Information published.

Quelle: CVE-2026-28387 Potential Use-after-free in DANE Client Code

CVE-2026-31789 Heap Buffer Overflow in Hexadecimal Conversion

BlackRabbitZ — Sun, 31 May 2026 08:18:05 +0000

Information published.

Quelle: CVE-2026-31789 Heap Buffer Overflow in Hexadecimal Conversion

CVE-2026-28388 NULL Pointer Dereference When Processing a Delta CRL

BlackRabbitZ — Sun, 31 May 2026 08:18:04 +0000

Information published.

Quelle: CVE-2026-28388 NULL Pointer Dereference When Processing a Delta CRL