590 matches found
CVE-2022-24924
LiveWallpaperService における不適切なアクセス制御の脆弱性 CVE-2022-24924（SVE-2021-24089） テスト済み Windows バージョン: Windows 10 20H2（ビルド 19042.1348）64bit Live Wallpaper バージョン: 3.0.9.0 以前 Samsung 製ノートパソコンではデフォルトで動作する LiveWallpaperService が存在しますが、SYSTEM サービス内で SYSTEM 特権を持つディレクトリに SYSTEM ディレクトリを作成する脆弱性がありました。 Live Wallpaper...
domain_analyzer
Domain Analyzer v0.8.3 What Domain analyzer is a security analysis tool that automatically discovers and reports information about a given domain. Its main purpose is to analyze domains in an unattended way. It has many crazy features, such as getting more domains from DNS zones, automatic nmap,...
Rocky Linux 9.6 [TuxCare] Security Update: podman / podman-docker / podman-plugins / podman-remote / etc (ALMALINUX9.6:CLSA-2026:1782987821)
The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782987821 advisory. - Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path...
AlmaLinux 9.2 [TuxCare] Security Update: podman / podman-docker / podman-gvproxy / podman-plugins / etc (ALMALINUX9.2:CLSA-2026:1782985538)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1782985538 advisory. - Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path...
CentOS Linux 7 [TuxCare] Security Update: ctdb / ctdb-tests / libsmbclient / libsmbclient-devel / libwbclient / etc (CENTOS7:CLSA-2026:1780064574)
The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1780064574 advisory. - All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be created in an...
CVE-2019-16784-POC
CVE-2019-16784 POC これは、--onefile オプションに存在する Windows PyInstaller バージョン 3.6 未満の脆弱性に対する私のPOCです。攻撃者は、pyinstaller バイナリで使用される Python インタプリタ DLL がインポートする DLL をハイジャックすることで、コマンド実行や可能性として LPE を達成できます。脆弱性と悪用プロセスの簡単な説明を以下に示します。Alter Solutions が脆弱性を発見し、PagedOut 3 PDF の 55 ページ にその発見について執筆してくれたことに感謝します。 脆弱性...
CVE-2025-46078
BUGAuthor: yggcwhat 影響を受けるバージョン: Huocms ベンダー: https://huocms.com/ ソースコードアドレス: https://gitee.com/digital-flag/huocms 脆弱性ファイル: Upload.php 影響を受けるバージョン： HuoCMS - controller backend 配下）の sliceUploadAndSave メソッドでは、resourcetype パラメータが許可されたファイル拡張子（txt、png など）のホワイトリストに対して検証されます。その後、メソッドは Upload.php（app...
CVE-2026-78677
A flaw was found in GitPython. This vulnerability allows a remote attacker to create arbitrary Git directories outside the intended clone destination. By manipulating the separategitdir parameter during repository cloning, an attacker can redirect repository metadata to an attacker-controlled...
CVE-2025-9435
ADManager Plus Build 7230 権限昇格 CVE-2025-9435 要件 'Modify user general properties'ロールを持ち、ADManagerがインストールされているサーバーへのログオンアクセス権を持つテクニシャンユーザー。 説明...
DirCreate2System
DirCreate2System 利用 Windows 错误报告，将特权目录创建漏洞武器化以获得 NT AUTHORITY\SYSTEM 权限 简短描述： 我发现 comctl32.dll （系统目录中缺失，实际上并不存在）已被 wermgr.exe 通过 Windows 错误报告执行 schtasks 时加载。这意味着如果我们能够创建一个名为 C:\windows\system32\wermgr.exe.local 的文件夹，并赋予其完全控制 ACL，就可以在该文件夹中劫持 comctl32.dll 。于是，我编写了这个 PoC，作为一种目录创建到 NT AUTHORITY\SYSTE...
CVE-2026-100689: Improper Limitation of a Pathname to a Restricted Directory
GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...
Linux Distros Unpatched Vulnerability : CVE-2026-100689
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27j...
CVE-2026-78394
The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including...
EUVD-2026-86528
The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including...
PT-2026-98359
Name of the Vulnerable Software and Affected Versions Link Library versions prior to 7.9.6 Description Insufficient sanitization of a user-supplied destination folder occurs when writing a generated image to disk. This allows users with the Contributor role and above to create directories and wri...
CVE-2026-91205: Race Condition Enabling Link Following
A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link symlink before the ownership change...
Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root
Summary LocalFolderExtractor validates only the final canonical file path before extraction. However, makeFile creates intermediate directories one path segment at a time without checking whether each created directory remains inside the destination folder. A malicious RAR entry can make the fina...
CVE-2026-86071: Improper Limitation of a Pathname to a Restricted Directory
Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtractor.java can create directories outside the intended extraction root when processing a crafted archive entry. LocalFolderExtractor.createFile validat...
CVE-2026-89767
A flaw was found in the Linux kernel's overlay file system overlayfs. An unprivileged local user can trigger a specific error condition during the creation of a new directory. This error causes the system to incorrectly release a lock on the parent directory and a reference to the new directory...