RottenPotato

This code is no longer maintained - for a newer implementation see https://github.com/breenmachine/RottenPotatoNG RottenPotato Local Privilege Escalation from Windows Service Accounts to SYSTEM For a technical overview of this exploit see our blog post at...

PrivescCheck

PrivescCheck Quickly identify common Windows vulnerabilities and configuration issues that are not necessarily covered by public security standards, and collect useful information for exploitation and post-exploitation tasks. !IMPORTANT A major aspect to be aware of when using this tool is that a...

CVE-2016-5195

CVE-2016-5195 gcc -pthread dirty.c -o dirty -lcrypt References https://github.com/FireFart/dirtycow/blob/master/dirty.c...

Research-CVE-2016-5195

CVE-2016-5195Dirty Cow Cow es copy-on-write , presente en los kernels de Linux desde 2007 y descubierta en 2016. Como estoy haciendo un laboratorio relacionado con este CVE, aprovecharé para escribir un análisis sobre él. 1. Introducción Como el kernel se ejecuta con privilegios de root, puede...

CVE-2021-3156-centos7

CVE-2021-3156-centos7 利用sudo提权，只针对cnetos7 受影响版本： sudo: 1.8.2 - 1.8.31p2 sudo: 1.9.0 - 1.9.5p1 以非root用户登录系统，并运行如下命令： sudoedit -s / 回显是 not a regular file 多半是存在该漏洞 使用方法： 首先使用非root用户登录，然后将/etc/passwd里面所有的内容复制到CVE-2021-3156.py的APPENDCONTENT = b"""\n""";里面，将改普通用户的uid和gid都改成0然后运行CVE-2021-3156.py文件...

PoC--CVE-2019-10149_Exim

PoC-CVE-2019-10149Exim MNEMO-CERT 开发了一个 PoC，可利用影响 Exim 多个版本（4.87 - 4.91）的漏洞 CVE-2019-10149，以提升权限执行命令。 要本地利用该漏洞，需要定义要执行的命令。对于远程场景，仅考虑了 Exim 未使用 ACL "verify= recipient" 的情况，此时除了命令外还需指定服务的 IP 地址和端口。 MNEMO-CERT 开发此 PoC 仅出于教育目的，并用于执行能够复现 CVE-2019-10149 所述漏洞的伦理测试。此 PoC 应仅在受控环境或获得必要授权的情况下使用。...

CVE-2026-49919

In ttfacecolrblendlayer of ttcolr.c, there is a possible remote code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28612

In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-49883

CVE-2026-49883 affects Android Wear (per the 2026-09-01 security bulletin) and involves a missing permission check in the checkReadPermission method of PermissionsManager.java. This allows an attacker to monitor sensitive device state data without requiring additional execution privileges or user...

EUVD-2026-74050

In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-49927

CVE-2026-49927 affects Android , as referenced by the September 2026 Android Security Bulletin. The root cause is an integer overflow in multiple locations that can lead to an out-of-bounds write , enabling local privilege escalation with only low privileges required and no user interaction. The ...

CVE-2026-45515

CVE-2026-45515 affects the Android A2DP vendor Opus decoder (a2dp_vendor_opus_decoder.cc), where a heap buffer overflow in the a2dp_vendor_opus_decoder_decode_packet function allows an out-of-bounds write. This can lead to local escalation of privilege with no additional execution privileges requ...

EUVD-2026-73969

In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28596

In parseInterventionFromXml of GameManagerService.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28594

In multiple locations, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-20514

CVE-2026-20514 affects MediaTek's Audio HAL , where a missing permission check can allow a local attacker with System privilege to disclose information without user interaction. The impact is limited to confidentiality (CVSS 3.1: 4.4, Medium). The vendor references Patch ID ALPS11087632 and Issue...

EUVD-2026-72200

In Audio HAL, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11191981; Issue ID: MSV-9125...

CVE-2026-20507

CVE-2026-20507 is a use-after-free vulnerability in the Audio HAL of MediaTek devices. The flaw enables local privilege escalation from the System privilege level, with no user interaction required. The CVSS 3.1 base score is 6.7 (MEDIUM) , reflecting the high privileges already needed for exploi...

PUB-A-508733257

In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

ASB-A-497544808

In multiple functions of NfcService.java, there is a possible silent payment session hijacking enablement due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...