CVE-2020-16125-Reproduction

CVE-2020-16125-Reproduction Questo repository ha lo scopo di riprodurre l'attacco . Descrizione : Il suo nome originale è “Ubuntu gdm3 privilege escalation” , ed è stata trovata da un ricercatore di sicurezza di Github di nome Kevin Backhouse . Il suo punteggio CVSS è 4.6/10 medio e l'ambiente...

CVE-2021-3560

CVE-2021-3560 un exploit affidabile basato su C per CVE-2021-3560. Sommario: Ieri mi sono imbattuto in questo post del blog di Kevin Backhouse lo scopritore di questa vulnerabilità, ho provato i comandi bash forniti nel post e, con mia sorpresa, ha funzionato sulla mia macchina Kali Linux!...

polkit-auto-exploit

polkit-auto-exploit Automatischer Exploit-PoC für Polkit CVE-2021-3560 Zusammenfassung CVE-2021-3560 ist ein Authentifizierungs-Bypass in polkit, der es nichtprivilegierten Benutzern ermöglicht, privilegierte Methoden mittels DBus aufzurufen. In diesem Exploit rufen wir zwei privilegierte Methode...

CVE-2021-3560-Polkit-Privilege-Escalation

CVE-2021-3560-Polkit-Privilege-Escalation di Mark, Qingchen Yu Per creare il container con docker build -t . Per eseguire il container docker run -it 1. inizia con start.sh 2. Misura il tempo di esecuzione: Nota il tempo 'real' e calcola la metà. time dbus-send --system...

CVE-2021-3560-Polkit-Privilege-Esclation

CVE-2021-3560-Polkit-Escalation-dei-Privilegi-PoC Ricerca originale di Kevin Backhouse Questo è solo uno script PoC in Bash che automatizza i passaggi di sfruttamento menzionati nel blog di Kevin Backhouse. Leggi il suo articolo su questa vulnerabilità:...

Polkit-exploit

Polkit-exploit - CVE-2021-3560 Escalation dei privilegi con polkit - CVE-2021-3560 Sommario CVE-2021-3560 è un bypass dell'autenticazione su polkit, che consente a un utente non privilegiato di chiamare metodi privilegiati tramite DBus. In questo exploit chiameremo due metodi privilegiati forniti...

CVE-2021-3560-PolkitPrivilegeEsclation

CVE-2021-3560-Polkit-Privilege-Esclation PoC Ricerca originale di Kevin Backhouse Questo è solo uno script Bash PoC che automatizza i passaggi di sfruttamento menzionati nel blog di Kevin Backhouse. Leggi il suo post su questa vulnerabilità:...

SUSE CVE-2026-61897

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 root. A shell spawned by a helper script inherits ruid=0 and may reset its...

SUSE CVE-2026-61898

The Ubuntu-specific language helper scripts save-to-pam-env, update-langlist shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in /.pamenvironment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an...

CVE-2026-61898

A flaw was found in accountsservice. A local attacker can exploit this by injecting arbitrary shell commands into the user-controlled LANGUAGE entry in the /.pamenvironment file. The Ubuntu-specific language helper scripts process this input unescaped, leading to arbitrary code execution with roo...

CVE-2026-61897

A flaw was found in AccountsService. An Ubuntu-specific patch for AccountsService did not fully drop root privileges when launching language helper scripts. This oversight allows a local user to exploit the incomplete privilege drop, potentially enabling them to reset their effective user ID to...

CVE-2026-61897

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 root. A shell spawned by a helper script inherits ruid=0 and may reset its...

CVE-2026-61898

The Ubuntu-specific language helper scripts save-to-pam-env, update-langlist shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in /.pamenvironment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an...

CVE-2026-61898 accountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scripts

The Ubuntu-specific language helper scripts save-to-pam-env, update-langlist shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in /.pamenvironment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an...

CVE-2026-61898

The Ubuntu-specific language helper scripts save-to-pam-env, update-langlist shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in /.pamenvironment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an...

EUVD-2026-63380

The Ubuntu-specific language helper scripts save-to-pam-env, update-langlist shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in /.pamenvironment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an...

CVE-2026-61898 accountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scripts

The Ubuntu-specific language helper scripts save-to-pam-env, update-langlist shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in /.pamenvironment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an...

CVE-2026-61898

CVE-2026-61898 is a shell injection in the Ubuntu-specific language helper scripts (save-to-pam-env , update-langlist ) shipped with accountsservice before version 23.13.9-8ubuntu7 . The user-controlled LANGUAGE entry in ~/.pam_environment is interpolated unescaped into a GNU sed replacement expr...

CVE-2026-61897

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 root. A shell spawned by a helper script inherits ruid=0 and may reset its...

CVE-2026-61897 accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 root. A shell spawned by a helper script inherits ruid=0 and may reset its...