CVE-2024-32019-ndsudo-local-privilege-escalation-NetData

CVE-2024-32019 Prova di Concetto Python Un'implementazione Python dell'exploit per l'escalation dei privilegi locali LPE per Netdata CVE-2024-32019. Questo script sfrutta una vulnerabilità nel componente ndsudo in cui la variabile d'ambiente PATH non viene adeguatamente sanificata. Ciò consente a...

CVE-2024-32019-Netdata-ndsudo-Privilege-Escalation-PoC

CVE-2024-32019 Netdata ndsudo PoC di Elevazione dei Privilegi Riepilogo CVE-2024-32019 è una vulnerabilità locale di elevazione dei privilegi nell'helper SUID ndsudo di Netdata che permette a un utente locale di eseguire programmi arbitrari come root tramite un percorso di ricerca non affidabile...

-Netdata-PrivEsc-CVE-2024-32019

CVE-2024-32019-Netdata-ndsudo-PrivEsc CVE-2024-32019: Netdata ndsudo PrivEsc HTB Editor Automatisiertes Bash-Skript zur Ausnutzung der PATH-Hijacking -Schwachstelle im SUID-Binary ndsudo von Netdata CVE-2024-32019. Dieser Exploit wurde speziell angepasst, um die üblichen Einschränkungen in...

-Linux-PrivEsc-CVE-2024-48990

Privesc-need-restart-2024-48990 Spiegazione dell'Exploit CVE-2024-48990 - Pure Python Questo script sfrutta la vulnerabilità CVE-2024-48990 nell'utilità needrestart di Linux tramite il dirottamento del percorso delle librerie PYTHONPATH hijacking. A differenza del vettore originale, questo metodo...

CVE-2024-32019-POC

CVE-2024-32019-POC Netdata ndsudo lokale Privilegieneskalation – Workflow und POC CVE-2024-32019 Workflow Automatischer Exploit Ressourcen Workflow !TIP Bitte lesen Netdata ist ein Tool zur Überwachung von Anwendungen und Systemen. Es läuft auf Port 19999 und ist leicht zu finden: root@kitploit:...

CVE-2024-32019-POC

Privilegieneskalation via ndsudo Netdata Lokaler Exploit Dieser POC wird verwendet, um eine verwundbare ndsudo-Dienstprogramm auszunutzen, das mit Netdata gebündelt ist, um lokale Privilegien auf root zu eskalieren. Der Exploit funktioniert, indem eine schädliche Binärdatei in den PATH des...

EUVD-2026-63696

Uncontrolled search path element in Windows Remote Help allows an authorized attacker to deny service locally...

CVE-2025-0041

Uncontrolled search paths in the Vitis™ Embedded Single File Download SFD for local Windows installation could allow a low-privileged user to create arbitrary code execution...

EUVD-2025-210694

Uncontrolled search paths in the Vitis™ Embedded Single File Download SFD for local Windows installation could allow a low-privileged user to create arbitrary code execution...

PT-2026-70360

Name of the Vulnerable Software and Affected Versions Vitis Embedded Single File Download SFD affected versions not specified Description Uncontrolled search paths in the local Windows installation of the Vitis Embedded Single File Download SFD may allow a low-privileged user to achieve arbitrary...

PT-2026-70333

Uncontrolled search path for some EquiTriton before version f5ddbb5 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially...

GO-2026-5426 Opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking in go.opentelemetry.io/otel/sdk

Opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking in go.opentelemetry.io/otel/sdk...

Security Bulletin: IBM CloudPak for Data Scheduling Service is vulnerable to CVE-2026-24051.

Summary OpenTelemetry Collector is used by the CP4D Scheduling Service for telemetry collection. CVE-2026-24051. Vulnerability Details CVEID:CVE-2026-24051 DESCRIPTION: OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to...

Operation-West-Wild-2.0

Operation West Wild 2.0 – Penetration Testing Report 📌 Ove...

Security Bulletin: IBM Security QRadar Log Management AQL Plugin is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. IBM Security QRadar Log Management AQL Plugin has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-24051 DESCRIPTION:...

CVE-2026-39883

A flaw was found in OpenTelemetry-Go. On BSD and Solaris platforms, a local attacker could exploit a vulnerability related to the kenv command. By manipulating the system's PATH environment variable, an attacker could achieve arbitrary code execution or privilege escalation, leading to a compromi...

CVE-2026-39883 OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms. This...

CVE-2026-39883 OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms. This...

EUVD-2026-20630

opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking...

opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking

Summary The fix for GHSA-9h8m-3fm2-qjrq CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms. Root Cause sdk/resource/hostid.go line 42: if result, err :=...