CVE-2020-28243

CVE-2020-28243 SaltStack的Salt中存在一个命令注入漏洞，当master调用restartcheck时，minion上经过特殊构造的进程名称可实现权限提升。完整分析请参见这篇博客文章 受影响版本： 2016.3.0rc2 至 3002.2 之间的所有版本 链接： Mitre, NVD 需求 要使此漏洞利用生效，需要满足以下条件： 版本在 2016.3.0rc2 至 3002.5 之间的 SaltStack Minion 对 SaltStack 未明确忽略的目录具有写/执行权限 Master 需要在此 minion 上调用...

Shell3er

Shell3er Shell3er PowerShell 反弹 Shell Shell3er 反弹功能 Get-RandomProcessName 函数 Get-RandomProcessName 函数通过将 "PS" 与一个新的 GUID 拼接来生成一个随机的进程名称。这用于创建独特且看似随机的进程名，使得识别可疑进程更加困难。 Run-BackgroundTask 函数 Run-BackgroundTask 函数接受一个 ScriptBlock 参数和一个可选的 ProcessName...

CVE-2022-39197-RCE

CVE-2022-39197-RCE 简介 本项目改编自 @its-arun 的项目 https://github.com/its-arun/CVE-2022-39197 在我测试该脚本时，发现 frida 脚本无法按正常顺序查询数据。这里采用修改 frida 脚本来修改进程名的方法。 感谢 @Kai5174 大师对利用方法所做的贡献。 使用方法 准备 Payload 1、在 EvilJar/src/main/java/Exploit.java 中编辑你的 payload 要执行的命令，目前它只能弹出计算器。 2、使用 jar 构建：mvn clean compile...

CVE-2026-14852 mk_sap_hana: Privilege escalation via crafted sapstartsrv process name

Privilege escalation in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 EOL allows a local unprivileged user to execute arbitrary commands as root by starting a process crafted to look like a SAP HANA instance. Without an explicit database...

CVE-2026-32608

Glances is an open-source system cross-platform monitoring tool. The Glances action system allows administrators to configure shell commands that execute when monitoring thresholds are exceeded. These commands support Mustache template variables e.g., name, key that are populated with runtime...

GHSA-VCV2-Q258-WRG7 Glances has a Command Injection via Process Names in Action Command Templates

Summary The Glances action system allows administrators to configure shell commands that execute when monitoring thresholds are exceeded. These commands support Mustache template variables e.g., name, key that are populated with runtime monitoring data. The securepopen function, which executes...

PT-2026-25767

A local attacker can bypass OpenEDR's 2.5.1.0 self-defense mechanism by renaming a malicious executable to match a trusted process name e.g., csrss.exe, edrsvc.exe, edrcon.exe. This allows unauthorized interaction with the OpenEDR kernel driver, granting access to privileged functionality such as...

CVE-2025-69783

CVE-2025-69783 concerns OpenEDR’s 2.5.1.0 self-defense mechanism. A local attacker can rename a malicious executable to a trusted process name (for example, csrss.exe, edrsvc.exe, edrcon.exe), enabling unauthorized interaction with the OpenEDR kernel driver. This exposes privileged functionality ...

SQL Injection

Overview Glances is an A cross-platform curses-based monitoring tool Affected versions of this package are vulnerable to SQL Injection via the normalize function in the TimescaleDB export module, which constructs SQL queries using unsanitized system monitoring data such as process names, filesyst...

Information Disclosure

github.com/canonical/lxd is vulnerable to Information Disclosure. The vulnerability is due to insufficient validation of process names, where attackers with root access in a container can spoof command-line names to impersonate other containers and obtain their metadata...

EUVD-2001-0903

Malware in sbrugna...

EUVD-2012-6351

Malware in sbrugna...

CVE-2025-54288 Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server

Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any container to impersonate other containers and obtain their metadata, configuration, and device information via spoofed process names in the...

PT-2025-40331

Name of the Vulnerable Software and Affected Versions Canonical LXD versions 4.0 and above Description An information spoofing issue exists in the devLXD server component of Canonical LXD. Attackers with root privileges within a container can impersonate other containers and access their metadata...

USN-6948-1 salt vulnerabilities

It was discovered that Salt incorrectly handled crafted web requests. A remote attacker could possibly use this issue to run arbitrary commands. CVE-2020-16846 It was discovered that Salt incorrectly created certificates with weak file permissions. CVE-2020-17490 It was discovered that Salt...

Exploit for Server-Side Request Forgery in Havocframework Havoc

CVE-2024-41570: Havoc-C2-SSRF-poc This vulnerability is exploi...

CVE-2022-39172

A stored XSS in the process overview bersicht zugewiesener Vorgaenge in mbsupport openVIVA c2 20220101 allows a remote, authenticated, low-privileged attacker to execute arbitrary code in the victim's browser via name field of a process...

CVE-2022-39172

A stored XSS in the process overview bersicht zugewiesener Vorgaenge in mbsupport openVIVA c2 20220101 allows a remote, authenticated, low-privileged attacker to execute arbitrary code in the victim's browser via name field of a process...

PT-2023-13703 · Unknown · Mbsupport Openviva C2

Name of the Vulnerable Software and Affected Versions: mbsupport openVIVA c2 version 20220101 Description: A stored XSS issue in the process overview allows a remote, authenticated, low-privileged attacker to execute arbitrary code in the victim's browser via the name field of a process...

CVE-2022-39172

A stored XSS in the process overview bersicht zugewiesener Vorgaenge in mbsupport openVIVA c2 20220101 allows a remote, authenticated, low-privileged attacker to execute arbitrary code in the victim's browser via name field of a process...