CVE-2025-32462-Exploit

CVE-2025-32462-Exploit：Matrix-Sudo 逃脱 主机名欺骗权限提升 CVE-2025-32462 “你吃下蓝色药丸……故事结束。你吃下红色药丸……你将获得 root。” 描述 该漏洞利用程序演示了 sudo 中的一个权限提升漏洞 CVE-2025-32462，其中基于主机名的限制可以通过 -h 参数绕过。PoC 创建一个受限用户环境，然后通过欺骗白名单中的主机名来逃逸，从而获得 root 访问权限。 root@kitploit: user@matrix-node$ sudo -h zion-core bash 欺骗白名单主机名 root@matrix-node...

uncle-spufus

█░░█ █▀▀▄ █▀▀ █░░ █▀▀ █▀▀ █▀▀█ █░░█ █▀▀ █░░█ █▀▀ v1.6" █░░█ █░░█ █░░ █░░ █▀▀ ▀▀█ █░░█ █░░█ █▀▀ █░░█ ▀▀█" ░▀▀▀ ▀░░▀ ▀▀▀ ▀▀▀ ▀▀▀ ▀▀▀ █▀▀▀ ░▀▀▀ ▀░░ ░▀▀▀ ▀▀▀" Uncle Spufus v1.6 一个自动执行MAC地址和主机名欺骗的工具 什么是Uncle Spufus 我的长篇故事...

advisories

Sobre mí Twitter: @justinsteven Blog: https://www.justinsteven.com/ Avisos de seguridad Listados en orden cronológico inverso. Haz clic en cualquier título para leer el aviso completo. Gartner Peer Insights Widget postMessage DOM XSS Fecha de divulgación: 2023-02-03 El Gartner Peer Insights Widge...

Improper Handling of Length Parameter Inconsistency

Overview resolv is a Thread-aware DNS resolver library in Ruby. Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency via Resolv::DNS::MessageEncoderputstring, putlabel, and Resolv::DNS::Name.create in lib/resolv.rb. An attacker can make an...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

CVE-2026-50248

A flaw in Unbound allows a remote attacker to replace an authenticated or Response Policy Zone RPZ by spoofing DNS records for configured primary hostnames. This enables the attacker to impersonate the primary server, leading to DNS cache poisoning or traffic redirection. Mitigation Configure...

erlang: Erlang OTP public_key: Certificate validation bypass allows hostname spoofing

A flaw was found in Erlang OTP publickey. This improper certificate validation vulnerability allows a subordinate Certificate Authority CA with restricted DNS nameConstraints to bypass these restrictions. By issuing a leaf certificate that lacks a Subject Alternative Name SAN but contains a craft...

CVE-2026-71290 Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

CVE-2026-50248

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record no valid RRSIG required becomes the zone'...

unbound: Unbound: DNS response policy replacement via hostname spoofing

A flaw in Unbound allows a remote attacker to replace an authenticated or Response Policy Zone RPZ by spoofing DNS records for configured primary hostnames. This enables the attacker to impersonate the primary server, leading to DNS cache poisoning or traffic redirection...

OESA-2026-3013 rpm-ostree security update

rpm-ostree is a hybrid image/package system. It supports "composing" packages on a build server into an OSTree repository, which can then be replicated by client systems with atomic upgrades. Additionally, unlike many "pure" image systems, with rpm-ostree each client system can layer on additiona...

Important: Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (erlang) security update

An update for erlang is now available for Red Hat OpenStack Services on OpenShift 18.0 Antelope. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

erlang: Erlang OTP public_key: Certificate validation bypass allows hostname spoofing

A flaw was found in Erlang OTP publickey. This improper certificate validation vulnerability allows a subordinate Certificate Authority CA with restricted DNS nameConstraints to bypass these restrictions. By issuing a leaf certificate that lacks a Subject Alternative Name SAN but contains a craft...

CVE-2026-54282

Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating scheme://hostpath and re-parsing the result, a path that does not begin with / for example...

Azure Linux 3.0 Security Update: pam (CVE-2024-10963)

The version of pam installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-10963 advisory. - A flaw was found in pamaccess, where certain rules in its configuration file are mistakenly treated as hostname...

TencentOS Server 4: pam (TSSA-2024:1020)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:1020 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2025-11720

The Firefox and Firefox Focus UI for the Android custom tab feature only showed the "site" that was loaded, not the full hostname. User supplied content hosted on a subdomain of a site could have been used to fool a user into thinking it was content from a different subdomain of that site. This...

CVE-2025-11720

The Firefox and Firefox Focus UI for the Android custom tab feature only showed the "site" that was loaded, not the full hostname. User supplied content hosted on a subdomain of a site could have been used to fool a user into thinking it was content from a different subdomain of that site. This...

PT-2025-41908

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 144 Firefox Focus versions prior to 144 Description The user interface for the Android custom tab feature in Firefox and Firefox Focus displayed only the "site" loaded, and not the complete hostname. This allowed...

idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded

A flaw was found in idna crate. This vulnerability allows hostname spoofing and potential privilege escalation via specially crafted Punycode labels that render as ASCII or empty labels, leading to incorrect equality comparisons during hostname validation...