39355 matches found
CVE-2022-0847
CVE-2022-0847 説明 - CVE-2022-0847 の POC: Linux カーネルのローカル権限昇格脆弱性。 詳細 - セキュリティ研究者の Max Kellermann 氏は責任を持って「Dirty Pipe」脆弱性を開示し、Linux カーネル 5.8 以降（Android デバイスを含む）に影響を与えると述べました。 - Linux カーネル 5.8 以降の脆弱性で、任意の読み取り専用ファイルのデータを上書きできるものです。これにより、権限のないプロセスが root プロセスにコードを注入できるため、権限昇格につながります。 - Linux カーネルの...
Astra Linux – Vulnerability in p7zip
7-Zip 22.01 does not report an error for certain invalid xz files that involve stream flags and reserved bits. Some later versions are unaffected...
CVE-2025-63666
CVE-2025-63666 — Tenda AC15 摘要 Tenda AC15 固件 V15.03.05.18multi 以 password= 的形式颁发认证 Cookie，并在没有 HttpOnly、Secure 或 SameSite 标志的情况下返回，从而将密码哈希暴露给客户端。 低熵后缀充当可预测的会话标识符，允许攻击者重放或劫持会话。 影响 用户密码哈希暴露给客户端。 通过可预测的 Cookie 值进行重放或会话劫持。 可利用 MD5 哈希前缀进行离线暴力破解。 技术细节 / 示例 /login/Auth 颁发格式为 password= 的 Cookie。 Cookie...
CVE-2018-6574-go-get-RCE
CVE-2018-6574-go-get-RCE この問題は、パッケージのインストール時にGolangがネイティブ拡張をビルドするという事実に起因します。これにより、コンパイラに追加フラグを渡してコード実行を行うことが可能になります。例えば、CFLAGSを使用できます。 以下のコマンドを使用してビルドできます： $ gcc -shared -o attack.so -fPIC attack.c 完全なペイロードをGithubにホストしたら、パッケージリンクを被害者に渡すことができます。...
cobol-shield
cobol-shield 面向 COBOL 遗留系统的安全审计工具包 VTR 研究方法论的一部分 | DOI: 10.5281/zenodo.22063208 状态：可复现 | 许可证：MIT | 领域：关键基础设施 功能简介 检测 GnuCOBOL 源代码中的编译上下文差异、不可见 Unicode 攻击以及不安全的 COBOL 模式。同一个源文件使用 -fixed 与 -free 编译会产生不同的程序——本工具使这种差异可观察、可复现。 三条命令复现 git clone https://github.com/LuisCastellanos-dev/cobol-shield cd...
CVE-2022-0847-L-nux-PrivEsc
CVE-2022-0847 描述 - CVE-2022-0847 的概念验证代码：Linux 内核本地权限提升漏洞。 - 由 antx 于 2022-03-08 创建。 详情 - 安全研究员 Max Kellermann 负责任地披露了“脏管道”漏洞，并指出该漏洞影响 Linux 内核 5.8 及更高版本，甚至影响 Android 设备。 - 自 Linux 内核 5.8 以来存在一个漏洞，允许覆盖任意只读文件中的数据。这会导致权限提升，因为非特权进程可以将代码注入到根进程中。 - 发现 Linux 内核中 copypagetoiterpipe 和 pushpipe...
CVE-2025-6019
CVE-2025-6019: libblockdev 本地權限提升漏洞 總結 CVE-2025-6019 是一個在 libblockdev 函式庫中發現的本地權限提升 LPE 漏洞，它與 udisks2 守護程式和 Polkit 協同作用。 漏洞描述 具有 allowactive Polkit 權限的本地攻擊者（通常是實際操作電腦的使用者）可以利用 libblockdev 與 udisks 守護程式互動的方式。攻擊者可以製作一個惡意的 XFS 映像檔，其中包含一個 SUID-root shell，並誘騙 udisks 在沒有 nosuid 和 nodev...
Rocky Linux 9 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (crlsa-2023_3923)
The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20233923 advisory. golang: cmd/go: go command may generate unexpected code at build time when using cgo CVE-2023-29402 golang: cmd/go: go command may execute arbitrary code a...
AZL-105912 CVE-2026-12345 affecting package tensorflow 2.16.1-11
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the...
CVE-2026-12345 Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the...
CVE-2026-12345 Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the...
EUVD-2026-89183
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the...
PSF-2026-42
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the...
PT-2026-102811
Name of the Vulnerable Software and Affected Versions simple-git versions prior to 4.0.0 Description The default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings, but Git accepts unambiguous long-option abbreviations. This allows attacker-influenced...
CVE-2026-67236
A flaw was found in rabbitmq-server. This vulnerability allows information disclosure due to insecure handling of authentication cookies following a login request. The application stores base64-encoded user credentials in a cookie that lacks essential security flags, such as Secure, HttpOnly, and...
CVE-2026-97997
In the Linux kernel, the following vulnerability has been resolved: virtioring: fix stale descriptor flags after a failed packed add In a packed ring the AVAIL and USED bits sit in the descriptor itself, so writing them makes that descriptor available. Those bit combinations flip meaning on every...
UBUNTU-CVE-2026-97997
In the Linux kernel, the following vulnerability has been resolved: virtioring: fix stale descriptor flags after a failed packed add In a packed ring the AVAIL and USED bits sit in the descriptor itself, so writing them makes that descriptor available. Those bit combinations flip meaning on every...
CVE-2026-97997 virtio_ring: fix stale descriptor flags after a failed packed add
In the Linux kernel, the following vulnerability has been resolved: virtioring: fix stale descriptor flags after a failed packed add In a packed ring the AVAIL and USED bits sit in the descriptor itself, so writing them makes that descriptor available. Those bit combinations flip meaning on every...
CVE-2026-97997
In the Linux kernel, the following vulnerability has been resolved: virtioring: fix stale descriptor flags after a failed packed add In a packed ring the AVAIL and USED bits sit in the descriptor itself, so writing them makes that descriptor available. Those bit combinations flip meaning on every...
CVE-2026-97997
The Linux kernel contains a vulnerability in the virtio_ring component where a failed packed add can leave stale AVAIL and USED bits in the descriptors. When vring_map_one_sg() fails mid-operation, unmap_release restores flags but leaves descriptors marked as available. This causes the device to ...