CVE-2021-3560-Polkit-DBus

CVE-2021-3560-Polkit-DBus Einfaches Proof-of-Concept-Skript für CVE-2021-3560 Polkit D-Bus Privilege Escalation. Weitere Informationen finden Sie im ursprünglichen Blogbeitrag: https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/ Verwendung Versuchen Sie das Skript b...

pack2theroot-lab

Pack2TheRoot Lab — CVE-2026-41651 Un laboratorio Dockerizzato in stile CTF per l'escalation locale dei privilegi, costruito attorno all'advisory Pack2TheRoot CVE-2026-41651, una vulnerabilità di 12 anni nel demone PackageKit divulgata dal Red Team di Deutsche Telekom il 22 aprile 2026. Il...

CVE-2026-41651

CVE-2026-41651 — PackageKit TOCTOU स्थानीय विशेषाधिकार वृद्धि वर्गीकरण: पर्पल टीम मूल्यांकन आर्टिफैक्ट केवल अधिकृत उपयोग के लिए। यह दस्तावेज़ और साथ में दी गई परीक्षण स्क्रिप्ट केवल उन प्रणालियों पर आंतरिक सुरक्षा सत्यापन के लिए हैं जहाँ लिखित प्राधिकरण प्राप्त किया गया है। शोषण का प्रमाण विषय-सू...

ageverificationbypass

AgeVerificationBypass AVB Das Sanctuary-Protokoll für souveräne Systeme Warum muss ich einen Ausweis vorlegen, um mich in einer Linux-VM anzumelden? Das ist nicht angemessen. 🚨 Das Problem: Die Archon-Altersbeschränkung Seit 2026/2027 haben große Distributionen Ubuntu und Fedora damit begonnen, d...

CVE-2021-3560

Exploit de Bypass de Autenticação Polkit D-Bus Existe uma vulnerabilidade no serviço de sistema polkit que pode ser explorada por um atacante local sem privilégios para realizar operações privilegiadas. Para explorar a vulnerabilidade, o atacante invoca um método através do D-Bus e mata o process...

NimbusPWN-CVE-2022-29799-29800

NimbusPwn — Escalação de Privilégio Local em networkd-dispatcher !NOTE Outras d...

CVE-2021-3560

CVE-2021-3560 - Polkit Lokale Privilegienausweitung ⚠️ Nur für Bildungszwecke und autorisierte Sicherheitsforschung Ursprüngliche Exploit-Autoren Vielen Dank an den ursprünglichen PoC-Autor @UNICORDev von @NicPWNs und @Dev-Yeoj Beschreibung Es wurde festgestellt, dass Polkit dazu gebracht werden...

CVE-2021-3560

CVE-2021-3560 Privilegienerhöhung durch Race Condition in polkit. Beschreibung der Schwachstelle CVE-2021-3560 ist eine Race Condition in polkit, die es einem nicht authentifizierten lokalen Benutzer ermöglicht, Root-Rechte zu erlangen. Die Schwachstelle besteht in der Art und Weise, wie polkit...

CVE-2026-61898

A flaw was found in accountsservice. A local attacker can exploit this by injecting arbitrary shell commands into the user-controlled LANGUAGE entry in the /.pamenvironment file. The Ubuntu-specific language helper scripts process this input unescaped, leading to arbitrary code execution with roo...

CVE-2026-41651

CVE-2026-41651 root@kitploit: CVSS 3.x : 7.8 HIGH CWE : CWE-367 Time-of-Check Time-of-Use Fix : PackageKit 1.3.5+ Affects : PackageKit 1.0.2 – 1.3.4 Escalata locale dei privilegi tramite condizione di gara TOCTOU nel gestore delle transazioni D-Bus di PackageKit. Qualsiasi utente locale senza...

CVE-2026-61898

The Ubuntu-specific language helper scripts save-to-pam-env, update-langlist shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in /.pamenvironment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an...

EUVD-2026-63380

The Ubuntu-specific language helper scripts save-to-pam-env, update-langlist shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in /.pamenvironment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an...

CVE-2026-61898

CVE-2026-61898 is a shell injection in the Ubuntu-specific language helper scripts (save-to-pam-env , update-langlist ) shipped with accountsservice before version 23.13.9-8ubuntu7 . The user-controlled LANGUAGE entry in ~/.pam_environment is interpolated unescaped into a GNU sed replacement expr...

CVE-2026-61898

The Ubuntu-specific language helper scripts save-to-pam-env, update-langlist shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in /.pamenvironment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an...

glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...

glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...

glib2 security update

2.68.4-19.9 - Fix CVE-2026-15588: limit D-Bus auth line read length 2.68.4-19.8 - Fix CVE-2026-58010: off-by-one in GVariant tuple offset checking - Resolves: RHEL-212157 2.68.4-19.7 - Fix CVE-2026-58012: buffer overflow in gregex.c with GREGEXRAW - Resolves: RHEL-212217 2.68.4-19.6 - Fix...

JLSEC-2026-1248 A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL...

A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...

udisks2: udisks2: Local Privilege Escalation via as-user option spoofing

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on...

glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"

A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a node element nested within other elements like method, signal, property or arg. This issue can cause an...