CVE-2024-0670

CVE-2024-0670 – Повышение привилегий в агенте CheckMK PowerShell PoC Аннотация В этом репозитории представлена независимая proof-of-concept реализация на PowerShell для CVE-2024-0670 — уязвимости локального повышения привилегий в Windows-агенте CheckMK. Уязвимость позволяет локальному пользовател...

CVE-2024-0670-CheckMK-Agent-Local-Privilege-Escalation-Exploit

CVE-2024-0670 – Локальное повышение привилегий агента CheckMK PoC Этот репозиторий содержит простую и чистую proof-of-concept для CVE-2024-0670 — уязвимости локального повышения привилегий в агенте CheckMK для Windows. Пользователь с низкими привилегиями может получить права SYSTEM, злоупотребив...

msi-search

MSI Search Windows кэширует MSI-файлы в C:\Windows\Installer\ со случайными именами, состоящими из букв и цифр, после которых следует расширение «.msi». Этот инструмент упрощает для операторов red team и специалистов по безопасности задачу определения, каким программам соответствуют те или иные...

mindmanager-poc

mindmanager-poc Затронутое приложение: MindManager23setup.exe Платформа: Windows Проблема: локальное повышение привилегий через режим восстановления MSI-установщика состояние гонки при перехвате EXE Обнаружено и сообщено: Pawel Karwowski и Julian Horoszkiewicz Eviden Red Team Предлагаемое...

HTB-NanoCorp-CVE-2024-0670

CVE-2024-0670 — Повышение привилегий через восстановление MSI агента CheckMK NanoCorp HTB Этот репозиторий содержит скрипт PowerShell, используемый для эксплуатации CVE-2024-0670 на машине NanoCorp с Hack The Box. Уязвимость позволяет пользователю с низкими привилегиями злоупотребить...

Linux Distros Unpatched Vulnerability : CVE-2026-83598

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without...

CVE-2026-83597 Netdata: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution

Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user who triggers repair can interact with or...

EUVD-2026-84567

Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user who triggers repair can interact with or...

CVE-2026-83597 Netdata: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution

Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user who triggers repair can interact with or...

CVE-2026-83597 Netdata: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution

Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user who triggers repair can interact with or...

EUVD-2026-84565

Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShellprofile.ps1 from the low-privileged user who initiated repai...

CVE-2026-83598 Netdata: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repair

Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShellprofile.ps1 from the low-privileged user who initiated repai...

CVE-2026-83598 Netdata: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repair

Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShellprofile.ps1 from the low-privileged user who initiated repai...

CVE-2026-83598 Netdata: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repair

Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShellprofile.ps1 from the low-privileged user who initiated repai...

CVE-2026-83598: Improper Privilege Management

Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShellprofile.ps1 from the low-privileged user who initiated repai...

PT-2026-96843

Name of the Vulnerable Software and Affected Versions Netdata Windows Agent versions 2.0.0 through 2.10.3 Description The MSI repair process launches powershell.exe and wevtutil.exe as elevated interactive processes within the user's desktop session. A low-privileged local user can trigger this...

PT-2026-96844

Name of the Vulnerable Software and Affected Versions Netdata versions 2.0.0 through 2.10.3 Description During the MSI repair process of the Netdata Windows Agent, powershell.exe is executed with SYSTEM privileges without the -NoProfile flag. This causes the system to load the Microsoft.PowerShel...

HTB-NanoCorp-CVE-2024-0670

CVE-2024-0670 - Escalada de Privilegios en la Reparación MSI del Agente CheckMK NanoCorp HTB Este repositorio contiene un script de PowerShell utilizado para explotar CVE-2024-0670 en la máquina NanoCorp de Hack The Box. La vulnerabilidad permite a un usuario con pocos privilegios abusar de la...

Exploit for Uncontrolled Search Path Element in Checkmk

CVE-2024-0670 - CheckMK Agent MSI Repair Privilege Escalation...

Rockwell Automation FactoryTalk Linx

RISK EVALUATION Successful exploitation of these vulnerabilities may allow full access to all files, processes, and system resources. 2. RECOMMENDED PRACTICES CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also...