33136 matches found
CVE-2026-81302
CVE-2026-81302 is currently a reserved candidate with no publicly disclosed technical details. The only record is a sighting linked to JVN (Japan Vulnerability Notes). Monitor for updates as the reserving organization publicizes the vulnerability.
CVE-2025-55130
CVE-2025-55130 - Node.js权限模型符号链接逃逸 root@kitploit: / | | | | |/ \ / \ | | | | / | // \ | | || | || || || | | | | \ | \ \ | | | | | | |/|| \ ||| ||/||| | || | || | |/ |//||// Node.js权限模型绕过——通过精心构造的符号链接 发现者：natann @ JFrog 概述 Node.js中的一个路径遍历漏洞允许通过指向绝对路径的符号链接结合相对路径遍历，突破 --allow-fs-read 和...
santa
Santa !NOTE As of 2025, Santa is no longer maintained by Google. We encourage existing users to migrate to an actively maintained fork of Santa, such as https://github.com/northpolesec/santa. Santa is a binary and file access authorization system for macOS. It consists of a system extension that...
Azure-AccessPermissions
Azure-AccessPermissions Script de PowerShell fácil de usar para enumerar permisos de acceso en un entorno de Azure Active Directory. Los detalles de fondo se pueden encontrar en las publicaciones de blog adjuntas: Desenredando las Entidades de Seguridad y los Permisos de Acceso de Azure Active...
kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
A flaw was found in the Linux kernel's NFSv4 implementation. A local user could exploit a vulnerability where opening a file with OTRUNC truncate and ORDONLY read-only flags would bypass the necessary write permission checks. This oversight allows an attacker to truncate a file without having...
CVE-2024-23700
CVE-2024-23700 - PoC de escalada de privilegios en Android Companion Device Proyecto que ilustra CVE-2024-23700, una vulnerabilidad de escalada de privilegios relacionada con el mecanismo Companion Device en Android. El PoC demuestra que una aplicación puede aprovechar el flujo de vinculación de...
CVE-2026-0092
CVE-2026-0092 在包管理器中，由于缺少权限检查，可能存在设备锁控制器绕过的问题。这可能导致本地权限提升，且无需额外的执行权限。利用该漏洞无需用户交互。 NVD - CVE-2026-0092 Android 安全公告 - Android 17...
CVE-2026-11817
In multi-organization deployments, an Org Admin in one organization could call GET /api/access-control/users/permissions/search with actionPrefix=dashboards: and obtain dashboard and folder UIDs plus per-user permission mappings from other organizations. Single-organization deployments are not...
EUVD-2026-71613
JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. An authenticated attacker with any valid JWT token can access multiple API endpoints including queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds to retrieve...
Linux Distros Unpatched Vulnerability : CVE-2026-80757
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - selinux: reject a class permission count below its inherited common securitygetpermissions maps an inherited common's permissions into an array sized by the...
CVE-2026-75166
MBS-Solutions X-Serie Gateway firmware V6_00_05 contains an insecure permission configuration that allows a low-privileged service user to execute /usr/bin/tcpdump as root without a password. By exploiting the tcpdump -z option, an authenticated attacker can achieve arbitrary command execution wi...
UBUNTU-CVE-2026-80755
In the Linux kernel, the following vulnerability has been resolved: selinux: reject a permission value exceeding the class permission count permread bounds a permission value by SELVECMAX but never by the nprim of the owning class or common, which is taken verbatim from the policy image...
EUVD-2026-71447
Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V60005 allows the low-privileged service user to execute /usr/bin/tcpdump as root without a password. By leveraging the tcpdump -z option, an authenticated attacker can achieve arbitrary command execution...
MiracleLinux 8 : [security - high] nodejs:22 (AXSA:2026-1753:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1753:01 advisory. nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion vi...
UBUNTU-CVE-2026-80757
In the Linux kernel, the following vulnerability has been resolved: selinux: reject a class permission count below its inherited common securitygetpermissions maps an inherited common's permissions into an array sized by the class's own permissions.nprim, but classread takes that nprim verbatim...
ColorOS-CVE-2025-10184
信息来源 漏洞原理及解决方案技术原理 漏洞说明 类型：数据库注入攻击1=1 AND 效果：任意APP读取短信数据。 无需权限、无需用户交互、无感知读取 影响：本机的所有短信信息、短信验证码泄露 涉及范围：OPPO 及其子品牌一加、realme 影响范围：根据maoyixuan提交的机型显示， 17年发布的ColorOS 6.0.1存在漏洞，此漏洞可能伴随了OPPO的OEM生涯 修复情况：10月4日开始对ColorOS 15推送系统文件更新：15.0.0.860Patch01|1.9MB，10月9日对ColorOS 12-14推送 测试漏洞：国内下载...
raccoon
Raccoon：Salesforce 对象访问审计器 由 NCC Group Plc 以开源形式发布 - https://www.nccgroup.com/ 由 Jerome Smith @exploresecurity 开发（感谢 Viktor Gazdag @wucpi） https://www.github.com/nccgroup/raccoon 根据 AGPL 发布 - 更多信息请参阅 LICENSE。 描述 该工具基于有效的共享和对象设置，确定哪些配置文件（Profile）和权限集（Permission...
EUVD-2026-52279
SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure...
Quiksand-CVE-2023-24012
DDS Security Test Entorno de prueba de seguridad DDS para ROS 2, basado en ROS 2 Foxy. Descripción del proyecto Este proyecto demuestra una vulnerabilidad de omisión de permisos en el marco de seguridad SROS2 de ROS 2. Al modificar el archivo de permisos firmados, un atacante puede hacer que un...