CVE-2020-1283_Windows-Denial-of-Service-Vulnerability

CVE-2020-8103 漏洞利用 详细分析可在 RedyOps Labs 的博客中找到： https://labs.redyops.com/index.php/2020/04/27/dos-via-arbitrary-folder-creation/ 第三方工具 该利用代码大量基于 James Forshaw 开发的 symboliclink-testing-tools。symboliclink-testing-tools 可在此处找到： https://github.com/googleprojectzero/symboliclink-testing-tools...

CVE-2026-70622

A flaw was found in tar-rs. This vulnerability, a symlink escape, allows a local attacker to read sensitive files outside of the intended directory. By planting specially crafted symbolic links in an untrusted directory, an attacker can trick a privileged process, when archiving that directory,...

php: PHP: Denial of Service via circular symbolic links in phar archives

A flaw was found in PHP. When processing a specially crafted PHP Archive phar file containing circular symbolic links, the PHP process can enter an uncontrolled loop. This unbounded recursion exhausts the program's memory stack, causing the PHP application to crash. This vulnerability could allow...

CVE-2026-17106

A flaw was found in moby/go-archive. The tar extraction routines in the component do not properly restrict filesystem operations to the intended destination directory. An attacker who controls the contents of an archive can exploit this by including symbolic links, allowing them to create or...

php: PHP: Denial of Service via circular symbolic links in phar archives

A flaw was found in PHP. When processing a specially crafted PHP Archive phar file containing circular symbolic links, the PHP process can enter an uncontrolled loop. This unbounded recursion exhausts the program's memory stack, causing the PHP application to crash. This vulnerability could allow...

CVE-2024-23334

CVE-2024-23334 Prueba de concepto para la vulnerabilidad de LFI/Path Traversal en Aiohttp = !IMPORTANT Este script está destinado únicamente con fines educativos. Cualquier uso ilegal está estrictamente prohibido. ¿Cómo ejecutar? root@kitploit: $ git clone...

CVE-2026-33825

🔵 CVE-2026-33825 — “BlueHammer” 🔵 Escalada de Privilegios Local LPE de Microsoft Defender BlueHammer es una vulnerabilidad de Escalada de Privilegios Local de alta gravedad que afecta a componentes de Microsoft Defender en sistemas Windows. La falla permite a un atacante con pocos privilegios...

ALSA-2026:61259 Low: php security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext/openssl: memory corruption in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Servic...

git_rce

Attacco di Remote Code Execution tramite git clone CVE-2024-32002 Contributore Jeongwoo Lee @Roronoawjd Contesto Questa vulnerabilità è una RCE Remote Code Execution che si verifica quando si clona un repository Git che contiene sottomoduli su file system che non fanno distinzione tra maiuscole e...

CVE-2026-79676

A flaw was found in NLTK. This path traversal vulnerability allows attackers to bypass security measures by using symbolic links within trusted data roots. By staging specially crafted symlinked corpus files, an attacker can disclose sensitive information from outside the intended data directorie...

Astra Linux – Vulnerability in Git

Git is a version control system. Before versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories containing submodules could be exploited through a bug in Git. This bug allowed a script to be written into the .git/ directory instead of the submodule’s worktree. This enabl...

Astra Linux – Vulnerability in rsync

A flaw was discovered in rsync. This vulnerability stems from a race condition that occurs during rsync’s handling of symbolic links. The default behavior of rsync when encountering symbolic links is to skip them. If an attacker replaces a regular file with a symbolic link at the appropriate time...

Important: php:8.3 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...

EUVD-2026-39104

chrome-devtools-mcp: validatePath does not canonicalize symlinks before enforcing roots...

CVE-2026-16967

IBM i versions 7.6, 7.5, 7.4, and 7.3 are affected by CVE-2026-16967, a TOCTOU race condition involving symbolic links that could let a remote authenticated attacker gain unauthorized access to system objects. CVSS v3.1 base score 8.5 ( HIGH ) with network attack vector, high impact on confidenti...

PT-2026-71823

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description A time-of-check to time-of-use TOCTOU race condition involving symbolic links allows a remote authenticated attacker to gain unauthorized access to system objects. TOCTOU is a software bug where a...

[SECURITY] [DLA 4733-1] php7.4 security update

Debian LTS Advisory DLA-4733-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin August 11, 2026 https://wiki.debian.org/LTS Package : php7.4 Version : 7.4.33-1+deb11u12 CVE ID : CVE-2026-7260 CVE-2026-17543 Debian Bug : 1143153 Security issues were found in PHP, a...

[SECURITY] [DLA 4732-1] php8.2 security update

Debian LTS Advisory DLA-4732-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin August 11, 2026 https://wiki.debian.org/LTS Package : php8.2 Version : 8.2.33-1deb12u1 CVE ID : CVE-2026-7260 CVE-2026-17543 Debian Bug : 1143153 Security issues were found in PHP, a...

Astra Linux – Vulnerability in glib2.0

A flaw was discovered in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability enables a local attacker to...

SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2026:3513-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3513-1 advisory. - CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion bsc1273077. ...