2071 matches found
bmcweb
OpenBMC 웹서버 이 구성 요소는 OpenBMC를 위한 '만능' 임베디드 웹서버를 목표로 합니다. 특징 웹서버는 몇 가지 개별 인터페이스를 구현합니다. DBus 이벤트 웹소켓. 특정 dbus 경로, 속성의 변경 사항을 등록할 수 있으며, 필터가 일치하면 웹소켓에서 이벤트를 전송합니다. OpenBMC DBus REST API. dbus 및 그것이 나타내는 객체에 대한 직접적이고 간섭이 적으며 충실도가 높은 액세스를 제공합니다. 시리얼: 웹소켓을 통해 호스트 시리얼 콘솔과 상호작용하기 위한 시리얼 웹소켓입니다. Redfish:...
CVE-2021-3560
CVE-2021-3560 CVE-2021-3560을 위한 신뢰할 수 있는 C 기반 익스플로잇. 요약: 어제 나는 Kevin Backhouse이 취약점을 발견한 사람의 이 블로그 게시물을 우연히 발견했습니다. 블로그 게시물에 제공된 bash 명령을 시도했고 놀랍게도 내 Kali Linux 시스템에서 작동했습니다! CVE-2021-3560은 polkit의 인증 우회로, 권한이 없는 사용자가 DBus를 사용하여 권한 있는 메서드를 호출할 수 있게 합니다. PoC는 이 버그를 악용하여 accountsservice가 제공하는 2개의 권...
polkit-auto-exploit
polkit-auto-exploit Polkit CVE-2021-3560 자동 익스플로잇 PoC 요약 CVE-2021-3560은 polkit의 인증 우회 취약점으로, 권한이 없는 사용자가 DBus를 통해 권한 있는 메서드를 호출할 수 있게 해줍니다. 이 익스플로잇에서는 accountsservice에서 제공하는 두 가지 권한 있는 메서드CreateUser 및 SetPassword를 호출하여 권한 있는 사용자를 생성한 다음 비밀번호를 설정하고, 마지막으로 생성된 사용자로 로그인한 후 root로 권한 상승을 수행합니다...
POC-Bash-CVE-2021-3560
Bash-CVE-2021-3560 POC Bash -- CVE-2021-3560 Polkit 로컬 권한 상승 익스플로잇 이 저장소는 많은 현대 Linux 배포판에 영향을 미치는 polkit 의 로컬 권한 상승 취약점인 CVE-2021-3560에 대한 bash 익스플로잇을 제공합니다. !!!!!! 테스트 중이므로 불안정성이 발생할 수 있습니다 !!!!! 💥 취약점 요약 Kevin Backhouse 가 발견한 이 취약점은 polkit 인증 확인과 경합하여 권한이 없는 사용자가 dbus 인터페이스를 통해 관리자 권한 계정을 생성할 ...
CVE-2021-3560
Уязвимость Polkit - CVE-2021-3560 📕 Введение В 2021 году исследователь Кевин Бэкхаус обнаружил уязвимость повышения привилегий в утилите polkit. однако не все версии Linux уязвимы для polkit. Ниже приведен пример уязвимой версии; Red Hat Enterprise Linux 8 Fedora 21 или новее Debian Testing...
Polkit-CVE-2021-3560
Polkit-CVE-2021-3560 Предыстория В начале 2021 года исследователь по имени Кевин Бэкхаус обнаружил семилетнюю уязвимость повышения привилегий впоследствии обозначенную CVE-2021-3560 в утилите polkit в Linux. К счастью, разные дистрибутивы Linux и даже разные версии одних и тех же дистрибутивов...
Polkit-exploit
Polkit-exploit - CVE-2021-3560 Повышение привилегий с помощью polkit - CVE-2021-3560 Краткое описание CVE-2021-3560 — это обход аутентификации в polkit, который позволяет непривилегированному пользователю вызывать привилегированные методы через DBus. В этом эксплойте мы вызовем два...
SUSE CVE-2026-7867
A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on...
glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"
A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a node element nested within other elements like method, signal, property or arg. This issue can cause an...
glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"
A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a node element nested within other elements like method, signal, property or arg. This issue can cause an...
glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"
A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a node element nested within other elements like method, signal, property or arg. This issue can cause an...
glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"
A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a node element nested within other elements like method, signal, property or arg. This issue can cause an...
glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"
A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a node element nested within other elements like method, signal, property or arg. This issue can cause an...
CVE-2026-7867 Udisks2: udisks2: local privilege escalation via as-user option spoofing
A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on...
Oracle Linux 8 : mingw-glib2 (ELSA-2026-49512)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-49512 advisory. - Fix CVE-2026-58010: off-by-one error in gvstupleisnormal Resolves: RHEL-212164 - Fix CVE-2026-58011: gdatetimeaddfull range validation Resolves:...
mingw-glib2 security update
2.70.1-9 - Fix CVE-2026-58010: off-by-one error in gvstupleisnormal Resolves: RHEL-212164 2.70.1-8 - Fix CVE-2026-58011: gdatetimeaddfull range validation Resolves: RHEL-212184 2.70.1-7 - Fix CVE-2026-58013: memcmp buffer over-read in giochannel Resolves: RHEL-212234 2.70.1-6 - Fix CVE-2026-58012...
RHEL 8 : mingw-glib2 (RHSA-2026:49512)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:49512 advisory. GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in...
ALSA-2026:49512 Important: mingw-glib2 security update
GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fixes: glib: GLib: Buffer underflow...
Important: Red Hat Security Advisory: abrt security update
An update for abrt is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
abrt: TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump directories
A time-of-check time-of-use TOCTOU race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package...