CVE-2025-27591-below-

CVE-2025-27591 – Повышение привилегий в Below 1 Введение Below — это инструмент Linux для записи и отображения системных данных, таких как использование аппаратных средств и метрики cgroup. В версиях до v0.9.0 systemd-сервис Below запускается с привилегиями root и создаёт общедоступные для записи...

CVE-2023-41717

CVE-2023-41717 Несоответствующий контроль типа файлов в Zscaler Proxy версий 3.6.1.25 и ранее позволяет локальным злоумышленникам обходить ограничения на загрузку и скачивание файлов. Краткое описание Летом 2022 года я обнаружил уязвимость, затрагивающую прокси ZScaler версии 3.6.1.25 и ранее. Эт...

CVE-2023-43874-e107-CMS-Stored-XSS---MetaCustomTags

e107 CMS 저장형 XSS v2.3.2 작성자: Sergio 설명: e017 CMS v.2.3.2에서 다중 교차 사이트 스크립팅XSS 취약점이 발견되었습니다. 로컬 공격자가 Meta & Custom Tags Menu의 Copyright 및 Author 필드에 조작된 스크립트를 삽입하여 임의 코드를 실행할 수 있습니다. 공격 벡터: 'Meta & Custom Tags Menu'의 Copyright 및 Author 필드 입력값 검증 취약점으로 인해 사용자가 웹 페이지에 접근할 때 실행되는 JavaScript 코드를 삽입할 수...

exploit-CVE-2021-3560

Эксплойт для CVE-2021-3560 Polkit — локальное повышение привилегий Нравится этот репозиторий? Поставьте нам ⭐! Только для образовательных целей и авторизованных исследований безопасности. Автор эксплойта @UNICORDev от @NicPWNs и @Dev-Yeoj Описание уязвимости Было обнаружено, что polkit можно...

CVE-2023-1326-PoC

CVE-2023-1326-PoC CVE-2023–1326 및 apport-cli 2.26.0에 대한 개념 증명 이 취약점은 apport-cli 2.26.0의 권한 상승 취약점으로, CVE-2023–26604와 유사합니다. 이 취약점은 sudoers에 할당된 경우에만 작동합니다: apport-cli 2.26.0 및 이전 버전에서 CVE-2023-26604와 유사한 권한 상승 공격이 발견되었습니다. 시스템이 권한이 없는 사용자가 sudo apport-cli를 실행할 수 있도록 특별히 구성되어 있고, less가 페이저로 설정되어...

CVE-2025-47181

CVE-2025-47181 概念: Microsoft Edge リンク追従による特権昇格 プロジェクト概要 このリポジトリは CVE-2025-47181 概念 を提供します。これは、CVE-2025-47181 の仕組みと影響を説明するための Python プログラムです。これは Microsoft Edge（Chromium ベース） における 特権昇格の脆弱性 であり、「ファイルアクセス前の不適切なリンク解決（'リンク追従'）」CWE-59 に分類されます。この脆弱性により、権限を持つローカルの攻撃者がシステム上で特権を昇格させることが可能になります。 このプログラムには...

Smart s200 Management Platform v.S200 - SQL Injection

SQL Injection vulnerability in Baizhuo Network Smart s200 Management Platform v.S200 allows a local attacker to obtain sensitive information and escalate privileges via the /importexport.php component. id: CVE-2024-27718 info: name: Smart s200 Management Platform v.S200 - SQL Injection author:...

CVE-2021-36808

CVE-2021-36808 로컬 공격자는 버전 9.7.3115 이전의 Sophos Secure Workspace for Android에서 경쟁 조건race condition을 이용하여 앱 비밀번호를 우회할 수 있었습니다. 보안 권고: https://www.sophos.com/en-us/security-advisories/sophos-sa-20211029-ssw-pw-bypass 분석 글: https://ctulhu.me/posts/sophos-secure-workspace-app-password-bypass/...

CVE-2026-89627

A flaw was found in the Linux kernel's HID Human Interface Device roccat driver. When a roccat device is destroyed, the driver fails to properly free buffered reports, leading to a memory leak. A local attacker could potentially exploit this to exhaust system memory, resulting in a Denial of...

CVE-2026-81011

A flaw was found in the Linux kernel's hp-bioscfg module. The module's package parsers incorrectly determine the number of elements in a package, using a value derived from a name string rather than the true package size. While currently prevented by existing validation, a future change to the...

CVE-2026-89452

A flaw was found in the iommu/msm component of the Linux kernel. This vulnerability occurs when msmiommuprobe fails to properly unwind its probe state during registration, leaving a dangling list entry. A local attacker could potentially exploit this to cause a dereference of the dangling list...

CVE-2026-80972

A flaw was found in the ALSA Advanced Linux Sound Architecture aloop driver within the Linux kernel. This vulnerability arises from insufficient validation of the card index during device setup, specifically when a device is manually configured using the sysfs interface. A local attacker could...

CVE-2026-89641

A flaw was found in the Linux kernel's Common Internet File System CIFS module. This vulnerability, a use-after-free, occurs in the cifsfilesetsize function. When a file's size is being modified, a critical system resource tcon object can be released too early but then accessed again. A local...

CVE-2026-80974

A flaw was found in the mfd: sm501 component of the Linux kernel. This vulnerability arises from a failure to properly free allocated memory for struct sm501devdata during the device removal process. A local attacker could potentially exploit this memory leak, which may lead to a denial of servic...

CVE-2026-89491

A flaw was found in the Linux kernel's ocfs2 cluster module. This vulnerability allows a local attacker to trigger a denial of service. The issue arises when a sleeping function is called while a spinlock is held within the o2hbregionpin function, which can lead to a system crash or deadlock. Thi...

CVE-2026-89443

A flaw was found in the Linux kernel's platform/x86 ISST module. The isstifgetperflevelmask and isstifgetbasefreqmask functions fail to validate a user-provided 'level' parameter. A local attacker could exploit this by providing an invalid 'level' value, leading to an out-of-bounds read from the...

CVE-2026-81017

A flaw was found in the Linux kernel's sensorhub component. A local attacker could provide a maliciously crafted sensor number in an EC FIFO event. This unchecked sensor number could lead to an out-of-bounds read and write in the batchstate array, potentially causing memory corruption or system...

CVE-2026-89615

A flaw was found in the Linux kernel's NTFS3 file system driver. A local attacker could exploit this by providing a specially crafted log record. This crafted record causes a buffer overflow in the pagelcns array, leading to memory corruption within an otherwise valid entry...

CVE-2026-89471

A flaw was found in the Linux kernel's crosusbpd-charger driver. A malicious or compromised embedded controller EC can report an excessive number of USB Power Delivery PD ports. This causes the driver to write beyond the allocated memory buffer when populating a fixed-size array for port data,...

CVE-2026-89616

A flaw was found in the Linux kernel's NTFS3 filesystem driver. When decompressing LZNT data, the nireadframe function may not fully zero out memory after a partial decompression. This can lead to the disclosure of previously used kernel memory pages to a local attacker who reads a specially...