CVE-2024-21626

CVE-2024-21626 この脆弱性の詳細な説明については、私の記事を参照してください。 エクスプロイト コンテナの実行によるエクスプロイト カスタムイメージをビルドする必要はありません。-w パラメータを指定してコンテナを実行するだけです: docker run -w /proc/self/fd/8 --name cve-2024-21626 --rm -it debian:bookworm 実行中のコンテナへの exec によるエクスプロイト runc 自体によるエクスプロイト /container/runc/runc --version docker run --name...

CVE-2024-21262

記録 CVEの再現専用です。 関連リソース: LINK GITHUB1 GITHUB2 ISSUE 環境の確認 docker-24.0.6.tgz を https://download.docker.com/linux/static/stable/x8664/ からダウンロードします。 sudo mkdir -p /usr/local/docker-24.0.6 sudo tar -xzf docker-24.0.6.tgz -C /usr/local/docker-24.0.6 sudo ln -sf /usr/local/docker-24.0.6/docker/...

CVE-2024-21626

概要 再現手順 カーネルが 5.4,4.19,.. 以上であり、/proc/kallsyms に openat2 が存在することを確認してください。v1.0.0-rc93= runc =1.1.11 $ grep openat2 /proc/kallsyms ffffffffa64290d0 T pfxauditopenat2how ffffffffa64290e0 T auditopenat2how ffffffffa666de90 t pfxdosysopenat2 ffffffffa666dea0 t dosysopenat2 ffffffffa666e020 t...

CentOS Linux 7 [TuxCare] Security Update: gtk-update-icon-cache / gtk3 / gtk3-devel / gtk3-devel-docs / etc (CENTOS7:CLSA-2024:1728056039)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1728056039 advisory. - A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the...

AlmaLinux 9.2 [TuxCare] Security Update: gtk-update-icon-cache / gtk3 / gtk3-devel / gtk3-devel-docs / etc (ALMALINUX9.2:CLSA-2025:1745946091)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1745946091 advisory. - A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the...

CVE-2024-21626

CVE-2024-21626 エクスプロイト 作業ディレクトリ docker run -w /proc/self/fd/8 --name cve-2024-21626 --rm -it debian:bookworm 重要なのは -w /proc/self/fd/8 を指定することです\ コンテナ内で cat ../../../../../../../../../etc/passwd を実行して、ホストのファイルシステムにアクセスします エクスプロイト シンボリックリンク 1. docker run --name cve-2024-21626 --rm --it...

CVE-2025-56383

脆弱性 攻撃タイプ: DLL Hijacking DLLハイジャック 対象アプリケーション: Notepad++ 方法: NppExport.dll ファイルが Notepad++ によって作業ディレクトリから読み込まれる 実装 悪意のあるDLLには以下が含まれています: 互換性を確保するための元のライブラリのエクスポート関数 Reverse shell, 攻撃ホストに接続する 読み込みのブロックを防ぐために別スレッドで実行...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via reusable exec approvals that fail to bind the working directory context to the approval record. When an operator grants an allow-always approval for a command,...

CVE-2026-100530

OpenClaw versions before 2026.8.1 fail to bind working directory context to reusable exec approvals, allowing approved commands to execute in different directories. Attackers with an allow-always approval can reuse it to run the same command against unreviewed files or repositories with materiall...

PT-2026-99167

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description Reusable execution approvals fail to bind the working directory context, which allows approved commands to be executed in directories other than the one originally intended. An attacker possessin...

EulerOS Virtualization 2.11.0 : perl (EulerOS-SA-2026-3537)

According to the versions of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including...

Astra Linux – Vulnerability in jupyter-core

Jupyter Core is a package for the core common functionalities of Jupyter projects. Prior to version 4.11.2, Jupyter Core contained an arbitrary code execution vulnerability in “jupytercore,” which stemmed from “jupytercore” executing untrusted files in the CWD environment. This vulnerability...

Astra Linux – Vulnerability in exim4

Exim 4 before 4.94.2 allows out-of-bounds write-ups, because the main function, while having setuid root, copies the current working directory pathname into a buffer that is too small on some common platforms...

EUVD-2026-74295

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

GHSA-C7R6-VX3H-W5G2 Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path

Summary Excel::store resolved the destination path against the process working directory rather than the configured filesystem disk. When that path resolved to an existing file, the export was written straight to it with fopen, bypassing the disk entirely. An application that passes a...

NewStart CGSL MAIN 7.02 : perl Vulnerability (NS-SA-2026-0098)

The remote NewStart CGSL host, running version MAIN 7.02, has perl packages installed that are affected by a vulnerability: - Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide...

CVE-2026-53457 Blueprint Studio terminal command working directory not bounded to config directory

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in customcomponents/blueprintstudio/backend/terminalmanager.py accepted a cwd working-directory parameter and checked only whether the...

CVE-2026-53457

In Blueprint Studio before 2.5.2, the legacy terminal path in terminal_manager.py accepted a cwd parameter and only checked directory existence, allowing an admin to run commands in directories outside the Home Assistant config boundary, weakening filesystem restrictions. Fixed in version 2.5.2. ...

CVE-2026-72814 actix-web before 0.6.10 Information Disclosure via Files

The actix-files crate actixfiles before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is passed as the servefrom argument to Files::new, the mount path defaults to an empty path; the service then joins the request path with this empty path and...

Malicious code in wos-library-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3124274f6fcb74cf0805b5545f6952214b90329427f55c616c868f760d592e63 [email protected] declares scripts.preinstall = 'node poc.js', which auto-runs on npm install. poc.js reads os.hostname, os.userInfo.username, an...