reposaur

Reposaur Reposaur is the open source compliance tool for development platforms. Audit, verify and report on your data and configurations easily with pre-defined and/or custom policies. Supports GitHub. GitLab, BitBucket and Gitea support soon. ⚠️ before 1.0.0 expect some bugs and API changes ⚠️...

tricorne

Tricorne A Fedora Remix for offensive security. "My treasure? If you want it, I'll let you have it. Seek it out! I left everything at that place!" Gol D. Roger The short version Kali owns Debian. BlackArch owns Arch. Parrot owns the "security-focused desktop" niche. No one owns RPM-world offensiv...

trivy-repo

trivy-repo deb/rpm repository for Trivy Debian/Ubuntu $ sudo apt-get install wget apt-transport-https gnupg $ wget -qO - https://get.trivy.dev/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg /dev/null $ echo "deb signed-by=/usr/share/keyrings/trivy.gpg...

go-rpmdb

go-rpmdb Library for enumerating packages in an RPM DB Packages file without bindings. package main import "fmt" "log" rpmdb "github.com/knqyf263/go-rpmdb/pkg" func main if err := run; err != nil log.Fatalerr func run error db, err := rpmdb.Open"./Packages" if err != nil return err pkgList, err :...

CVE-2024-22026

CVE-2024-22026 Exploit POC for CVE-2024-22026 affecting Ivanti EPMM "MobileIron Core" CVE-2024-22026 is a local privilege escalation vulnerability in Ivanti EPMM formerly MobileIron server versions prior to 12.1.0.0, 12.0.0.0, and 11.12.0.1. This vulnerability allows a local attacker to gain root...

polkit-0.96-CVE-2021-4034

polkit-0.96-CVE-2021-4034 CentOS 7.x already has an RPM package that fixes the CVE-2021-4034 vulnerability, but I couldn't find one for CentOS 6.x. I created and packaged the RPM myself by referring to the source code Red Hat has already fixed 6.x, but I couldn't find a download location...

CVE-2015-7547

CVE-2015-7547 glibc vulnerability test script This provides a shell script for testing the glibc vulnerability CVE-2015-7547. It's written for rpm based systems such as Red Hat Enterprise Linux / RHEL / CentOS 5/6/7. Detection for other distributions may follow. Resolution 1. Run bin/test-glibc.s...

CLEANSTART-2024-XC53652 There is a flaw in RPM's signature functionality

Security vulnerability affects the rpm package. There is a flaw in RPM's signature functionality...

CLEANSTART-2024-UR96483 It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created

Security vulnerability affects the rpm package. It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created...

CLEANSTART-2024-ZT64756 race condition vulnerability was found in rpm

Security vulnerability affects the rpm package. A race condition vulnerability was found in rpm...

tippa-my-tongue

Tippa My Tongue Tippa My Tongue is an exploit that uses CVE-2022-1388 and CVE-2022-41800 to establish a root reverse shell on F5 BIG-IP products. Most CVE-2022-1388 exploits achieve code execution using /mgmt/tm/util/bash. However, this exploit uses /mgmt/shared/iapp/rpm-spec-creator, followed by...

CVE-2026-41651

🚨 CVE-2026-41651 — Pack2TheRoot Privilege Escalation Vulnerability in PackageKit TOCTOU Race Condition 📌 Overview CVE-2026-41651 is a local privilege escalation vulnerability affecting the PackageKit system service used in various Linux distributions. The vulnerability is caused by a Time-of-Chec...

CVE_kernellinux_jsh

CVEkernellinuxjsh — kernelsec Framework Author: jshDevs · Version: 0.1.0-scaffold · License: MIT Modular Bash framework for auditing and remediating critical Linux kernel CVEs on RPM-based distributions AlmaLinux 8/9, Rocky Linux 8/9, CentOS Stream 8/9/10. Covered CVEs CVE| Subsystem| Type| CVSS|...

CVE-2026-64561-Kernel-Fix

中文 | English 中文 升级 Linux Kernel 修复 CVE-2026-64561 教程 声明： 本文仅记录本人服务器环境下的修复过程，并非安全专业分析。如有不当之处，欢迎指正。 一、简介 本文档提供两种方式将 Linux Kernel 升级，用于修复 CVE-2026-64561 ：ELRepo RPM 安装（推荐）和源码编译。 项目| 说明 ---|--- CVE 编号| CVE-2026-64561 漏洞组件| Linux Kernel KVM/x86 修复方式| 升级 Linux Kernel（ELRepo RPM 或源码编译） 三、升级方法...

CentOS Linux 6 [TuxCare] Security Update: rpm / rpm-apidocs / rpm-build / rpm-cron / rpm-devel / rpm-libs / etc (CENTOS6:CLSA-2026:1793110602)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1793110602 advisory. - A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to...

OESA-2026-4596 mariadb security update

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon mariadbd and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: rpm (UTSA-2026-146970)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146970 advisory. A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec function in tools/rpmbuild.cc passes an...

rpm: Fix of CVE-2021-20271

CVE-2021-20271: signature check bypass via corrupted package header...

IPConfigure Orchid DNF GPG key rpm --import injection RCE

Authenticated PUT /service/server/properties taints package.dnf.repo.gpgkey; restart runs unquoted rpm --import as root OOB / blind. """IPConfigure Orchid DNF repo GPG key injection root RCE.""" from future import annotations import base64 import json import time from urllib.parse import urlencod...

CentOS Linux 7 [TuxCare] Security Update: rpm / rpm-apidocs / rpm-build / rpm-build-libs / rpm-cron / etc (CENTOS7:CLSA-2026:1792771843)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1792771843 advisory. - A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed b...