CVE-2026-82429 Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher

Description The setuid-root worker-launcher binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling lchown and chmod on each entry's full pathname while running with an effective uid of 0. Both syscalls re-resolve the path at the time of the call,...

CVE-2017-5123

CVE-2017-5123 Linux privilege escalation exploiting waitid syscall. The exploit is brought to you by @XeR0x2A and @chaignc from HexpressoTeam for educational purposes only. The bug was introduced the 2017-05-21 and fixed 2017-10-09, 4.14.0-rc4+ is known vulnerable. asciicast If you have a...

CVE-2026-82430 Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant

Description When launching a Docker or OCI worker, the setuid-root worker-launcher first changes ownership of the entire worker directory to the untrusted topology user, and only afterwards reads and acts on the command file that the supervisor wrote into that same directory. The file is opened...

CVE-2026-82430

CVE-2026-82430 affects the setuid-root worker-launcher in Apache Storm . A TOCTOU race condition occurs because the launcher changes ownership of the worker directory to the untrusted topology user before reading the command file, which is opened without O_NOFOLLOW and without re-verifying its ow...

EUVD-2026-77527

Description When launching a Docker or OCI worker, the setuid-root worker-launcher first changes ownership of the entire worker directory to the untrusted topology user, and only afterwards reads and acts on the command file that the supervisor wrote into that same directory. The file is opened...

CVE-2020-9442

Exploit Title: OpenVPN Connect for Windows MSI - 3.1.0.361 - Privilege Escalation Date: 2020-02-28 Author: Andrew Hess Software Link: https://openvpn.net/client-connect-vpn-for-windows/ Version: 3.1.0.361 MSI CVE: CVE-2020-9442 History 2019.12.15 - Vulnerability discovered 2019.12.15 - Initial...

Mindmaps

Pentesting Azure Mindmap Get the Global Admin access 💥 with this mindmap for Azure penetration tests. Feel free to pull request with your techniques ! ❤️ Developed by Alexis Danizan Released as open source by Synacktiv 🥷 📖 Resources Useful resources used to build this mindmap, many outstanding...

CVE-2020-11890

Made by HK CVE-2020-11890: Improper input validations in the usergroup table class could lead to a broken ACL configuration to RCE Link https://developer.joomla.org/security-centre/810-20200402-core-missing-checks-for-the-root-usergroup-in-usergroup-table.html PoC Affected version: Joomla core...

CVE-2025-32463

CVE-2025-32463 Local Privilege Escalation to Root via Sudo chroot in Linux. What's This? For the news, you can read here: https://www.helpnetsecurity.com/2025/07/01/sudo-local-privilege-escalation-vulnerabilities-fixed-cve-2025-32462-cve-2025-32463/ TL;DR and CMIIW So, sudo is a command to run a...

CVE-2022-32250-exploit

CVE-2022-32250-Linux-Kernel-LPE Demo Video https://www.youtube.com/watch?v=YqmwA6fPjKE About CVE-2022-32250 allows a local user to escalate privileges to root because an incorrect NFTSTATEFULEXPR check leads to a use-after-free. Reference Linux Kerenel Exploit CVE-2022-32250 with mqueue Affected...

CVE-2023-4911-PoC

GNU C Library's Dynamic Loader Vulnerability CVE-2023-4911 Overview The GNU C Library glibc serves as the C library in the GNU system and is integral to Linux-based systems. At its core, glibc defines essential functionalities for programs, including system calls and common functions like open,...

CVE-2025-6934

🛡️ CVE-2025-6934 - Opal Estate Pro 中的未认证权限提升 📝 描述 用于 WordPress 的 Opal Estate Pro – 房产管理与提交 插件（被 FullHouse - 房地产响应式 WordPress 主题 使用）在所有版本（包括 1.7.5 ）中均存在 权限提升 漏洞。 CVE 编号: CVE-2025-6934 CVSS 评分: 9.8（严重） 发布时间: 2025年6月30日 ⚙️ 脚本信息 此 Python 利用脚本通过以下方式自动化权限提升过程： 通过 readme.txt 验证易受攻击的插件版本。 从注册页面获取所需的 nonce...

CVE-2022-0847-DirtyPipe-

CVE-2022-0847-DirtyPipe-Exploits A collection of exploits and documentation for penetration testers and red teamers that can be used to aid the exploitation of the Linux Dirty Pipe vulnerability. About The Vulnerability Dirty Pipe CVE-2022-0847 is a local privilege escalation vulnerability in the...

CVE-2020-0796

CVE-2020-0796 Overview: The compression feature added to SMBv3 starting from Windows 10/Server version 1903 contains an integer overflow vulnerability confirmed by Microsoft on 12/03/2020. It allows an attacker to perform Local Privilege Escalation LPE and Remote Code Execution RCE. Here we will...

CVE-2020-1472

CVE-2020-1472 Netlogon Remote Protocol Call MS-NRPC Privilege Escalation Zerologon The attack described here takes advantage of flaws in a cryptographic authentication protocol insecure use of AES-CFB8 that proves the authenticity and identity of a domain-joined computer to the Domain Controller...

ptrace_may_dream

ptracemaydream CVE-2026-46333 Local privilege escalation exploit for the ptracemayaccess mm=NULL race condition in pidfdgetfd2. When a process is dying and its mm has already been released, the kernel skips the ptrace access check entirely. By racing pidfdgetfd against process exit, an unprivileg...

CVE-2021-44103

CVE-2021-44103 A proof of concept for KONGA 0.14.9 - Privilege Escalation. Intro On November 16, 2021, Fabrício Salomão and I found a vulnerability in Konga API Gateways, allowing any authenticated user to become an administrator. Report Vulnerability Product: KONGA Model: 0.14.9 Vulnerability:...

CVE-2024-2432-PaloAlto-GlobalProtect-EoP

CVE-2024-2432 Palo Alto GlobalProtect EoP On Windows system, it was found that GlobalProtect App version 6.1.1-5 and 6.2.0-89 was vulnerable to arbitrary file delete with elevated privileges by symbolic link attack lead to local privilege escalation on local machine. It was observed that when a...

CVE-2026-82426

Apache Storm 's Nimbus component allowed an arbitrary file read via the uploadedJarLocation argument in submitTopology/submitTopologyWithOpts. The path was opened server-side without verifying it referred to a file the caller had uploaded, since the uploaders map was never consulted at submit tim...

CVE-2026-82426 Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location

Description Nimbus accepted the uploadedJarLocation argument of submitTopology / submitTopologyWithOpts as a server-side path and opened it directly, without checking that it referred to a file the caller had actually uploaded. The intended flow is that a client first calls beginFileUpload, which...