CVE-2020-1283_Windows-Denial-of-Service-Vulnerability

CVE-2020-8103 エクスプロイト 解説記事はRedyOps Labsのブログにあります: https://labs.redyops.com/index.php/2020/04/27/dos-via-arbitrary-folder-creation/ サードパーティツール このエクスプロイトコードは、James Forshawによって開発されたsymboliclink-testing-toolsをベースにしています。symboliclink-testing-toolsは以下から入手できます:...

CVE-2026-33825

🔵 CVE-2026-33825 — “BlueHammer” 🔵 Microsoft Defender Local Privilege Escalation LPE BlueHammer is a high-severity Local Privilege Escalation vulnerability affecting Microsoft Defender components on Windows systems. The flaw allows a low-privileged attacker to escalate privileges to NT...

CVE-2024-23334

CVE-2024-23334 针对 Aiohttp !IMPORTANT 此脚本仅供教育用途。 任何非法使用均严格禁止。 如何运行？ root@kitploit: $ git clone https://github.com/wizarddos/CVE-2024-23334 $ cd CVE-2024-23334 $ python3 exploit.py -u url -f file -d static directory !Note 记得使 URL 和静态目录中的斜杠匹配——如果你输入 http://127.0.0.1/，那么目录不要带斜杠（例如 static），反之亦然（URL...

git_rce

Remote Code Execution Attack via git clone CVE-2024-32002 Contributors 이정우@Roronoawjd Background This vulnerability is a Remote Code Execution RCE vulnerability that occurs when cloning a git repository containing submodules on case-insensitive file systems such as Windows and macOS. RCE is a...

php: PHP: Denial of Service via circular symbolic links in phar archives

A flaw was found in PHP. When processing a specially crafted PHP Archive phar file containing circular symbolic links, the PHP process can enter an uncontrolled loop. This unbounded recursion exhausts the program's memory stack, causing the PHP application to crash. This vulnerability could allow...

CVE-2026-70622

A flaw was found in tar-rs. This vulnerability, a symlink escape, allows a local attacker to read sensitive files outside of the intended directory. By planting specially crafted symbolic links in an untrusted directory, an attacker can trick a privileged process, when archiving that directory,...

RockyLinux 9 : php:8.2 (RLSA-2026:61903)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:61903 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archiv...

php: PHP: Denial of Service via circular symbolic links in phar archives

A flaw was found in PHP. When processing a specially crafted PHP Archive phar file containing circular symbolic links, the PHP process can enter an uncontrolled loop. This unbounded recursion exhausts the program's memory stack, causing the PHP application to crash. This vulnerability could allow...

CVE-2026-17106

A flaw was found in moby/go-archive. The tar extraction routines in the component do not properly restrict filesystem operations to the intended destination directory. An attacker who controls the contents of an archive can exploit this by including symbolic links, allowing them to create or...

php: PHP: Denial of Service via circular symbolic links in phar archives

A flaw was found in PHP. When processing a specially crafted PHP Archive phar file containing circular symbolic links, the PHP process can enter an uncontrolled loop. This unbounded recursion exhausts the program's memory stack, causing the PHP application to crash. This vulnerability could allow...

USN-8691-1: attr vulnerability

It was discovered that attr incorrectly handled symbolic links while traversing directory paths. A local attacker who controlled a pathname component could possibly use this issue to redirect privileged attr operations to arbitrary files and gain elevated privileges...

ALSA-2026:61259 Low: php security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext/openssl: memory corruption in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Servic...

CVE-2026-79676

A flaw was found in NLTK. This path traversal vulnerability allows attackers to bypass security measures by using symbolic links within trusted data roots. By staging specially crafted symlinked corpus files, an attacker can disclose sensitive information from outside the intended data directorie...

Astra Linux – Vulnerability in glib2.0

A flaw was discovered in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability enables a local attacker to...

Astra Linux – Vulnerability in Git

Git is an open-source distributed revision control system. In affected versions of Git, a specially crafted repository containing symbolic links and files processed by clean/smudge filters like Git LFS may cause a just-checked-out script to be executed when cloning to a case-insensitive file syst...

Astra Linux – Vulnerability in Git

Git is a version control system. Before versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories containing submodules could be exploited through a bug in Git. This bug allowed a script to be written into the .git/ directory instead of the submodule’s worktree. This enabl...

Important: php:8.3 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...

EUVD-2026-39104

chrome-devtools-mcp: validatePath does not canonicalize symlinks before enforcing roots...

CVE-2026-16967

IBM i versions 7.6, 7.5, 7.4, and 7.3 are affected by CVE-2026-16967, a TOCTOU race condition involving symbolic links that could let a remote authenticated attacker gain unauthorized access to system objects. CVSS v3.1 base score 8.5 ( HIGH ) with network attack vector, high impact on confidenti...

PT-2026-71823

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description A time-of-check to time-of-use TOCTOU race condition involving symbolic links allows a remote authenticated attacker to gain unauthorized access to system objects. TOCTOU is a software bug where a...