285 matches found
CVE-2023-38408
Уязвимость OpenSSH - CVE-2023-38408 📚 Введение Уязвимость была обнаружена в OpenSSH до версии 9.3p2. Функция PKCS11 в ssh-agent в OpenSSH имеет недостаточно надежный путь поиска, что приводит к удаленному выполнению кода, если агент пересылается на систему, контролируемую злоумышленником код в...
-Linux-PrivEsc-CVE-2024-48990
Privesc-need-restart-2024-48990 익스플로잇 설명 CVE-2024-48990 - 순수 Python 이 스크립트는 needrestart 유틸리티의 CVE-2024-48990 취약점을 라이브러리 경로 하이재킹PYTHONPATH hijacking을 통해 익스플로잇합니다. 원래 벡터와 달리 이 방법은 Python만을 사용하므로, 대상 머신에 gcc 같은 컴파일러가 설치되어 있어야 한다는 요구 사항을 우회할 수 있습니다. 단계별 작동 방식 1. 디렉토리 구조: /tmp/malicious/importlib 디렉토리...
EUVD-2026-40456
electron-updater: Uncontrolled search path elements within AppImage built by app-builder-lib...
electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`
Summary AppImage targets built by app-builder-lib could use an empty path component when setting the LDLIBRARYPATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by...
CVE-2026-46336 Manyfold: Authenticated Path Traversal via File Rename
Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. From 0.96.0 until 0.140.0, authenticated users can rename uploaded files with path traversal sequences because app/models/modelfile.rb uses the user-controlled...
TencentOS Server 2: glibc (TSSA-2025:1030)
The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:1030 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...
BIT-PYTHON-2026-12003 CPython >3.11 Insecure Input Validation resulting in privilege escalation
To allow builds of Python to be run from an in-tree layout rather than an installed file layout, the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local. When this landmark is found relative to VPATH relative to the executable, Python...
Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak System
Summary Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.1 and IBM Cloud Pak System version 2.3.5.1. Vulnerability Details CVEID:CVE-2025-0395 DESCRIPTION: When the assert function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for...
SUSE CVE-2026-54672
electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LDLIBRARYPATH environment variable at runtime. This causes the current working directory to be added to the dynamic linke...
CVE-2026-54672
A flaw was found in electron-updater, a component used for automatic updates in Electron applications. This vulnerability arises because AppImage targets, built by app-builder-lib, incorrectly add the current working directory to the dynamic linker search path when setting the LDLIBRARYPATH...
CVE-2026-54672
electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LDLIBRARYPATH environment variable at runtime. This causes the current working directory to be added to the dynamic linke...
CVE-2026-54672
electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LDLIBRARYPATH environment variable at runtime. This causes the current working directory to be added to the dynamic linke...
CVE-2026-54672 electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`
electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LDLIBRARYPATH environment variable at runtime. This causes the current working directory to be added to the dynamic linke...
CVE-2026-54369 acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions
acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions aclgetfile, aclsetfile, aclextendedfile, and acldeletedeffile that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who contr...
CVE-2026-11450
A vulnerability was detected in GL.iNet GL-MT3000 4.4.5. This affects the function dlopen in the library /usr/lib/oui-httpd/rpc/ of the component Path Normalization Handler. Performing a manipulation of the argument devname results in command injection. It is possible to initiate the attack...
Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: festival (UTSA-2026-016710)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016710 advisory. festivalserver in Centre for Speech Technology Research CSTR Festival, probably 2.0.95-beta and earlier, places a zero-length directory name in the LDLIBRARYPATH,...
CVE-2026-8745 Open5GS AUSF nausf-handler.c ogs_timer_add denial of service
A vulnerability was identified in Open5GS up to 2.7.7. Affected by this vulnerability is the function ogstimeradd in the library /src/ausf/nausf-handler.c of the component AUSF. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit is publicly available an...
PT-2026-41517
A vulnerability has been found in Open5GS up to 2.7.7. Affected is the function ogs sbi client add in the library /lib/sbi/client.c of the component NRF. The manipulation of the argument client pool leads to denial of service. It is possible to initiate the attack remotely. The exploit has been...
CVE-2026-44931 malcontent: Disk Space Exhaustion via Globally Accessible D-Bus API
The newly introduced RecordUsage D-Bus method https://gitlab.freedesktop.org/pwithnall/malcontent/-/blob/0.14.0/libmalcontent-timer/child-timer-service.c in malcontent-timerd allows arbitrary users in the system to slowly fill up disk space in /var/lib/malcontent-timerd...
