985 matches found
wildpwn
First things first! Read: https://www.exploit-db.com/papers/33930/ Basic usage It goes something like this: usage: wildpwn.py -h --file FILE payload folder Tool to generate unix wildcard attacks positional arguments: payload Payload to use: combined | tar | rsync folder Where to write the payload...
CVE-2021-4034
CVE-2021-4034 PoC for PwnKit: Local Privilege Escalation Vulnerability in polkit’s pkexec in Python Usage git clone https://github.com/rvizx/CVE-2021-4034 cd CVE-2021-4034 python3 cve-2021-4034-poc.py Notes C : https://github.com/arthepsy/CVE-2021-4034 Fix sudo chmod 0755 /bin/pkexec...
FileGator < 7.14.2 - Privilege Escalation
FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod' function through 'octdec' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root. id:...
CVE-2025-27591-Meta-below-LPE
CVE-2025-27591 — Meta below Symlink Local Privilege Escalation Overview Field| Details ---|--- CVE| CVE-2025-27591 Software| Meta below system resource monitor Affected Versions| 0.9.0 Vulnerability| Symlink following → arbitrary file overwrite as root Authentication| Local user with sudo access ...
EUVD-2026-90788
A flaw was found in ansible-runner. The unstreamdir function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/worker protocol, re-creates symbolic links from archive content without validating the link target and applies chmod and utime to an...
Rocky Linux 8 [CIQ] Security Update: python3-rpm / python3-rpm-debuginfo / rpm / rpm-apidocs / rpm-build / etc Multiple Vulnerabilities (crlsa-2024_0647)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20240647 advisory. rpm: TOCTOU race in checks for unsafe symlinks CVE-2021-35937 rpm: races with chown/chmod/capabilities calls during installation CVE-2021-35938 rpm: checks...
AlmaLinux 9.2 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (ALMALINUX9.2:CLSA-2024:1734531954)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1734531954 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when...
Rocky Linux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync (ALMALINUX9.6:CLSA-2026:1779959867)
The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779959867 advisory. - Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes,...
AlmaLinux 9.2 [TuxCare] Security Update: rsync / rsync-daemon (ALMALINUX9.2:CLSA-2026:1780486587)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780486587 advisory. - Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes,...
CentOS Linux 7 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (CENTOS7:CLSA-2025:1762544838)
The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1762544838 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starti...
Rocky Linux 8 [CIQ] Security Update: cups / cups-client / cups-client-debuginfo / cups-debuginfo / etc (crlsa-2024_4265)
The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20244265 advisory. cups: Cupsd Listen arbitrary chmod 0140777 CVE-2024-35235 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...
AlmaLinux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync (ALMALINUX9.6:CLSA-2026:1779959867)
The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779959867 advisory. - Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes,...
PT-2026-98499
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow occurs in the SMB client when rewriting a Discretionary Access Control List DACL. The functions replace sids and copy aces and set chmod dacl use a u16 accumulator to...
CVE-2026-54576 mport package installation has symlink TOCTOU in chown and chmod handling
mport is the MidnightBSD Package Manager. Prior to 2.7.8, doactualinstall in libmport/bundlereadinstallpkg.c used path-based lstat, chown, stat, and chmod operations while installing package files. A local attacker with write access to a target directory could replace a checked file with a symlin...
Time-of-check Time-of-use (TOCTOU) Race Condition
Overview org.apache.storm:storm-core is a distributed realtime computation system. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the worker-launcher process. An attacker can gain elevated privileges by exploiting a race condition between t...
EUVD-2026-77528
Description The setuid-root worker-launcher binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling lchown and chmod on each entry's full pathname while running with an effective uid of 0. Both syscalls re-resolve the path at the time of the call,...
CVE-2026-82429: Time-of-check Time-of-use (TOCTOU) Race Condition
Description The setuid-root worker-launcher binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling lchown and chmod on each entry's full pathname while running with an effective uid of 0. Both syscalls re-resolve the path at the time of the call,...
PT-2026-91227
Description The setuid-root worker-launcher binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling lchown and chmod on each entry's full pathname while running with an effective uid of 0. Both syscalls re-resolve the path at the time of the call,...
GHSA-F8G7-2XJC-7MFH rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination
Summary With -l/--links, rclone's local backend recreates a source .rclonelink object as a real symlink at the destination verbatim preserved by design for faithful backups. Directory-metadata application, however, does not go through the os.Root sandbox and does not use NOFOLLOW syscalls. A loca...
rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination
Summary With -l/--links, rclone's local backend recreates a source .rclonelink object as a real symlink at the destination verbatim preserved by design for faithful backups. Directory-metadata application, however, does not go through the os.Root sandbox and does not use NOFOLLOW syscalls. A loca...