CVE-2026-84414 IBM i is Affected By An Incorrect Permission Assignment Vulnerability in Network Authentication Service []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path...

EUVD-2026-89202

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path...

CVE-2026-84414

IBM i versions 7.6, 7.5, 7.4, and 7.3 are vulnerable to an incorrect permission assignment flaw in the Network Authentication Service (NAS) . A local authenticated attacker can change the ownership of arbitrary files because the system fails to properly validate attacker-controlled file paths whi...

CVE-2026-84414 IBM i is Affected By An Incorrect Permission Assignment Vulnerability in Network Authentication Service []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path...

CVE-2026-41490

CVE-2026-41490 — SQL Injection in Dagster database I/O managers via dynamic partition keys Severity : High CVSS 8.3 CWE : CWE-89 — SQL Injection Affected : Dagster core = 1.13.0 and integration packages = 0.29.0 Fixed in : Dagster core 1.13.1 and integration packages 0.29.1 Advisory :...

CVE-2014-4076

CVE-2014-4076 PoC This proof of concept directly copied from its original python version and rewritten in C++. Build This project is built with Visual Studio 2013 Update 4. Notice Only users that in Administrators group can open the device and perform IO controls, which means the exploit only...

CVE-2026-12485

🚨 CVE-2026-12485 - Critical Unauthenticated Remote Code Execution RCE GeoVision GV-I/O Box 4E – Firmware v2.09 Disclosure Date: June 23, 2026 CWE: CWE-121 – Stack-Based Buffer Overflow Attack Vector: Network Unauthenticated An unauthenticated stack-based buffer overflow vulnerability in the...

CVE-2023-30990

CVE-2023-30990 exploits See our blog post for details: https://blog.silentsignal.eu/2025/09/04/Exploit-development-for-IBM-i/ The Python scripts require the ebcdic module: pip install ebcdic DRDA S38CMD method python3 ddm.py "" DRDA SQL method python3 ddm-bypass-test.py "" Simple bindshell with...

MSI_FeatureManager_CVE

KernCoreLib64.sys Vulnerability PoC Physical Memory and I/O Port Abuse for Privilege Escalation...

CVE-2026-13714

Realtyna WPL 5.3.0 - Unauthenticated RCE Exploit Description This exploit targets a critical vulnerability in Realtyna Organic IDX + WPL Real Estate plugin versions prior to 5.3.0. The plugin uses hardcoded credentials and allows unauthenticated file upload leading to Remote Code Execution RCE...

PT-2026-102797

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Improper validation of an attacker-controlled file path allows a local authenticated attacker to change the ownership of arbitrary files. Recommendations At the moment, there is no information about a...

Amazon Linux 2 : 389-ds-base (ALAS-2026-3957)

The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3957 advisory. A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In...

CVE-2026-84414: Incorrect Permission Assignment for Critical Resource

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path...

CVE-2026-14960-CVE-2026-14961

Privilege Escalation Vulnerabilities in Pegatron TdeIo64 Driver tdeio64.sys | ---|--- CVE IDs| CVE-2026-14960, CVE-2026-14961 Vendor| Pegatron Corporation Product| TdeIo Driver tdeio64.sys Device Interface| \.\TdeIo Vulnerability Types| Improper Access Control CWE-284, Arbitrary Kernel Memory...

CVE-2023-37755---Hardcoded-Admin-Credential-in-i-doit-Pro-25-and-below

CVE-2023-37755 - Hardcoded Admin Credential in i-doit Pro 25 and below i-doit Pro 25 and below are vulnerable to Hardcoded admin credential vulnerability. These vulnerabilities could allows anyone to login as admin with just username “admin” and password “admin”. Description of product: i-doit is...

CVE-2023-46003

CVE-2023-46003 Stored XSS in i-doit Pro 25 and below i-doit Pro 25 and below are vulnerable to Stored XSS vulnerability. These could allows remote authenticated attackers low or high privilege to stores dangerous data xss payload or fake html page in a database, it will be trigger the xss payload...

CVE-2024-48326

CVE-2024-48326 Description: Portabilis i-Educar v2.8.0 is vulnerable to Cross-Site Scripting XSS via the nmreligiao parameter in POST request at /intranet/educarreligiaocad.php and trigged in GET request at /intranet/educarreligiaolst.php?busca=S&nmreligiao=. This allows an unauthenticated remote...

Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i

Summary IBM Rational Developer for i is affected by cross-site scripting vulnerabilities in DOMPurify CVE-2026-65898, CVE-2026-65900, CVE-2026-65901, CVE-2026-49458, CVE-2026-49459, CVE-2026-49978, CVE-2026-66010, and CVE-2026-75838, a protection mechanism failure vulnerability in DOMPurify...

kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released

A use-after-free vulnerability was identified in the Linux kernel framebuffer console fbcon subsystem. During framebuffer unregistration, the kernel freed the memory for a display mode but did not clear the corresponding fbdisplayi-mode pointer. Subsequent framebuffer ioctl operations could then...

ThrottleStopPoC

ThrottleStopPoC CVE-2025-7771 ：通过 ThrottleStop 驱动实现任意物理内存和 I/O 端口读写 ThrottleStop 是一个用于监控和纠正 CPU 降频的小型合法应用程序。它有一个驱动程序来协助完成这些任务，而且它基本上没有任何形式的输入验证。 存在漏洞的 IOCTL IOCTL| 漏洞 ---|--- 0x80006498| 任意内存读取 0x8000649C| 任意内存写入 0x80006430| 任意端口读取 0x80006434| 任意端口写入 似乎还存在任意 MSR 读写，但我没能让它们正常工作。 你可以自行研究。 读取 MSR 位于...