Document-Linux-Privilege-Escalation

Повышение привилегий в Linux через snapd Цель проекта: Эксплуатация уязвимости "DirtySock" CVE-2019-7304 в REST API демона snapd от Canonical служба по умолчанию в Ubuntu Linux для получения root-доступа. Руководство Рамиля Мустафаева:...

CVE-2024-26229-lpe

CVE-2024-26229 CWE-781: Некорректная проверка адреса в IOCTL с кодом управления вводом-выводом METHODNEITHER в драйвере csc.sys...

CVE-2019-10149

CVE-2019-10149 CVE-2019-10149 : В Exim версий с 4.87 по 4.91 включительно обнаружена уязвимость. Неправильная проверка адреса получателя в функции delivermessage в файле /src/deliver.c может привести к удаленному выполнению команд. Пример nc -lvp 9000 python ./CVE-2019-10149/exploit.py --rhost...

Malicious code in @dransay/address-validation (npm)

Source: ossf-package-analysis 82ababa5637b2f53f5087a161eeba1b6ca6ddba6d31ebb7842614bf0da119fa7 The OpenSSF Package Analysis project identified '@dransay/address-validation' @ 99.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

MAL-2026-17668 Malicious code in @dransay/address-validation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 189df4f2830e64a9cfbd0bed6ae8357aff16dc5496d83c3e5e4bd9457b536fa7 @dransay/[email protected] declares a preinstall script node beacon.js that fires on npm install and performs a DNS lookup plus HTTPS GET to ...

Malicious code in @dransay/address-validation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 189df4f2830e64a9cfbd0bed6ae8357aff16dc5496d83c3e5e4bd9457b536fa7 @dransay/[email protected] declares a preinstall script node beacon.js that fires on npm install and performs a DNS lookup plus HTTPS GET to ...

Malicious Package

Overview @dransay/address-validation is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-6060-QUIC-Handshake-Amplification-via-Address-Validation-Bypass

CVE-2026-6060 – Усиление рукопожатия QUIC через обход валидации адреса Программный код симуляция на Python quicserversim.py - Vulnerable QUIC server simulated handshake import socket def sendquicinitialconn, addr, serversalt: Respond with a large "server hello" without validating source address I...

OpenSMTPD-CVE-2020-7247-

Уязвимость удалённого выполнения команд в OpenSMTPD CVE-2020-7247 WHS 4-й набор, Пак Сольмин Оригинальная ссылка: https://github.com/vulhub/vulhub/blob/43eae7170d09e7748c3aac64cd6a8e5af508a8ef/opensmtpd/CVE-2020-7247/README.md Обзор OpenSMTPD — это SMTP-сервер, используемый в Unix-подобных...

CLEANSTART-2026-MP17411 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...

Security vulnerability affects the consul package. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped...

CLEANSTART-2026-ID88447 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...

Security vulnerability affects the kube-state-metrics-fips package. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped...

CLEANSTART-2026-TD03320 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...

Security vulnerability affects the containerd package. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped...

CVE-2026-35191

A flaw was found in OpenSSL. This vulnerability allows a remote attacker to abuse the server to amplify network traffic in a Denial of Service DoS attack. When the server is configured without client address validation, incoming datagrams containing multiple QUIC packets cause the server to...

Linux Distros Unpatched Vulnerability : CVE-2026-35191

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its...

CLEANSTART-2026-OJ26404 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...

Security vulnerability affects the loki package. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped...

EEF-CVE-2026-77972 safeurl validated address is not bound to the request, allowing DNS rebinding

Summary Time-of-check Time-of-use TOCTOU Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach internal network destinations that validation rejected. Validation returns a verdict and not the address it approved, so the HTTP clients the library ships...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: PowerPC: Fixed virtaddrvalid for 64-bit Book3E & 32-bit systems. MPE: On 64-bit Book3E, the vmalloc space starts at 0x8000000000000000. Due to the way pa works, pa0x8000000000000000 returns 0. Consequently,...

Astra Linux – Vulnerability in Zabbix

The URL validation scheme receives input from a user and then parses it to identify its various components. This validation scheme ensures that all URL components comply with internet standards...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: usb: asix: validate PHY address before use The ASIX driver reads the PHY address from the USB device via asixreadphyaddr. A malicious or faulty device may return an invalid address = PHYMAXADDR, which causes a warning in...

Astra Linux – Vulnerability in ldns

NLnet Labs’ ldns version 1.2.0, including versions up to and including 1.9.0, when used as a stub resolver over UDP, fails to match the query destination address and port with the response source address and port. Moreover, neither the query ID nor the nature of the query matches that of the...