CVE-2020-1066-EXP

Riferimento Questa vulnerabilità è una vulnerabilità di elevazione dei privilegi locali causata dalla sostituzione arbitraria di file dovuta alla gestione non corretta degli oggetti di collegamento simbolico da parte del servizio Windows CardSpace. Dichiarazione Il POC dell'autore è solo a scopo ...

TeleShadow2

TeleShadow 2 Teleshadow2- Advanced Telegram Desktop Session Hijacker! Stealing desktop telegrams has never been so easy ! Set the email and sender details of the sender and recipient or use Telegram API! and send it to the victim after compiling. How do I use the session file? Delete everything...

o365-attack-toolkit

Cos'è o365-attack-toolkit o365-attack-toolkit consente agli operatori di eseguire attacchi di phishing OAuth. Abbiamo deciso di passare dal vecchio modello di definizioni statiche a un modello completamente "interattivo" con l'account in tempo reale. Alcuni dei cambiamenti Ricerca interattiva del...

SetupHijack

SetupHijack Panoramica SetupHijack è uno strumento di ricerca sulla sicurezza che sfrutta le race condition e la gestione non sicura dei file nei processi di installazione e aggiornamento di Windows. Prende di mira scenari in cui programmi di installazione o aggiornamento privilegiati rilasciano...

dirtycow-replacer

BITTE BEACHTEN SIE, DASS ICH DIESEN CODE NICHT FORMELL TESTE ER WIRD ALS LEHRWERKZEUG ENTWICKELT Was macht es? android-dirtycow-replacer nutzt den CVE-2016-5195 DirtyCOW-Exploit, um eine Liste von über 1000 Dateien zu patchen. Sie können es auf 10000 erweitern, aber 1000 sollte reichen. Es prüft...

CVE-2017-4490-

CVE-2017-4490 Ho fatto alcuni esperimenti, sono riuscito a sfruttare il file .basgrc, specializzato nello scrivere e decorare il terminale. Ho creato una vulnerabilità nel file .bashrc e sono riuscito a bloccare il terminale. La vulnerabilità funziona su tutti i sistemi Linux perché figlet funzio...

EUVD-2026-95822

Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key,...

GHSA-MCR4-QMVW-PX4G yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

Summary When no system-installed liblz4-java is found, net.jpountz.util.Native.load extracts the bundled native library to java.io.tmpdir and loads it with System.load. The path of the extracted library can be predicted before it is created, and the library file is opened without exclusive...

yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

Summary When no system-installed liblz4-java is found, net.jpountz.util.Native.load extracts the bundled native library to java.io.tmpdir and loads it with System.load. The path of the extracted library can be predicted before it is created, and the library file is opened without exclusive...

yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

When no system-installed liblz4-java is found, net.jpountz.util.Native.load extracts the bundled native library to java.io.tmpdir and loads it with System.load. The path of the extracted library can be predicted before it is created, and the library file is opened without exclusive creation...

CVE-2026-106451 yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without...

CVE-2026-106451

The yawkat LZ4 Java library (versions 1.7.0 through 1.11.4 ) is vulnerable to a TOCTOU race condition during native library extraction. The net.jpountz.util.Native.load() function creates a temporary .lck file but uses a predictable path for the actual native library. Because FileOutputStream ope...

CVE-2026-106451 yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without...

FileSwitcherX

FileSwitcherX iOS 14.0-15.7.1 & 16.0-16.1.2 Installazione TrollStore AltStore Crediti https://github.com/zhuowei/MacDirtyCow exploit MacDirtyCow https://github.com/haxi0/TrollLock-Reborn https://twitter.com/i41nbeer CVE-2022-46689 https://twitter.com/straighttamago FileSwitcherX...

sudo_digest_toctou_poc_CVE-2015-8239

POC TOCTOU del DigestSpec di sudoers Motivazione Alyssa Milburn https://twitter.com/noopwafel ha scoperto un bug di condizione di gara TOCTOU in sudo quando viene utilizzata l'impostazione DigestSpec. L'impostazione DigestSpec può essere utilizzata per permettere a un utente di eseguire sudo su u...

CVE-2024-10449-patch

Patch per CVE-2024-10449 https://nvd.nist.gov/vuln/detail/CVE-2024-10449 Passaggi: Scarica il file loginAction.php corretto da questo repository https://raw.githubusercontent.com/g-u-i-d/CVE-2024-10449-patch/refs/heads/main/loginAction.php e sostituisci la versione vulnerabile con questo. Modific...

CVE-2026-97024

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files such as passwd, group, machine-id, or resolv.conf to be emptied or replaced with a symlink when the app is installed or upgraded...

CVE-2026-91813

A vulnerability in the Foxit PDF Editor/Reader update mechanism (specifically FoxitUpdater ) allows an update package to be replaced between download and high-privilege extraction due to insufficient file locking and integrity validation . This race condition could enable local attackers to execu...

CVE-2026-92763

Rundeck through 6.2.1 contains an authorization bypass in the project archive import endpoint. The importConfig and importNodesSources parameters are not properly authorized, allowing an attacker with only the import action to replace project configuration files, including security-relevant setti...

CVE-2026-92763 Rundeck through 6.2.1 Authorization Bypass via Project Import

Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with only the import action can replace project configuration files including security-relevant settings like node executors and SSH key paths tha...