CVE-2026-18567

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involving a predictable Unix domain socket path in a world-writable directory...

CVE-2026-18567

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 are affected by a TOCTOU race condition (CWE-367) involving a predictable Unix domain socket path in a world-writable directory. A local attacker with low privileges could exploit this to obtain information and cause minor availability impact, rated...

EUVD-2026-71602

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involving a predictable Unix domain socket path in a world-writable directory...

Linux-Privilege-Escalation-CVE-2025-27591

CVE-2025-27591 - belowにおける書き込み可能なシンボリックリンクを介した権限昇格 概要 これは CVE-2025-27591 に対するシンプルなエクスプロイトであり、Linux システム監視ツール below におけるローカル権限昇格脆弱性です。この脆弱性は v0.9.0 より前のバージョンに影響し、システム内の誤った権限割り当てに起因します。この問題は 2025 年 1 月に発見され、2025 年 3 月 12 日に公開されました SecurityOnline, OpenWall。below が sudo で実行されると、ワールド書き込み可能なディレクトリ...

CVE-2025-27591-PoC

CVE-2025-27591 PoC：本地权限提升（Below v0.9.0） CVE-2025-27591 的概念验证，该漏洞允许本地非特权用户通过符号链接攻击将权限提升至 root。 🕵️‍♂️ 技术细节 该漏洞影响 Below 服务（v0.9.0 之前的版本）。该服务创建了一个具有全局可写权限（0777）的 /var/log/below 目录，使得本地非特权用户可以移动符号链接并操纵关键文件（如 /etc/shadow），从而提升至 root 权限。 🧩 影响 本地非特权用户可通过以下方式提升至 root： 在 /var/log/below 中创建一个指向敏感系统文件的符号链接。 使用...

EUVD-2026-70652

Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit aws-fpga before 2.3.4 might allow local users to execute arbitrary code with root privileges via crafted shell content placed at a predictable path ...

CVE-2026-85028 Creation of Temporary File in Directory with Insecure Permissions in AWS FPGA Development Kit

Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit aws-fpga before 2.3.4 might allow local users to execute arbitrary code with root privileges via crafted shell content placed at a predictable path ...

CVE-2024-33352

CVEID ：CVE-2024-33352 Bluestacks 公告 ID ：待定 受影响产品及版本名称 ：BlueStacks for Windows（10.40.1000.502 之前的版本） 漏洞类型 ：CWE-552：外部方可访问的文件或目录 摘要 BlueStacks 是一款 Android 模拟器，它在虚拟机中运行客户机 Android 系统。由于 BlueStacks 将虚拟机配置文件存储在全局可写目录中，并在不同的操作系统用户之间共享这些文件，非特权用户有可能对镜像植入后门，从而获得特权用户的代码执行能力。 描述 BlueStacks 配置全局存储在 ProgramDa...

CVE-2025-27591-PoC

CVE-2025-27591 概念验证 CVE-2025-27591 是一个权限提升漏洞，影响了低于 0.9.0 版本的 Below 服务。问题源于在 /var/log/below 目录下创建了一个全局可写目录。攻击者可以通过操作该目录中的符号链接来利用此漏洞，并有可能获取 root 权限，这对本地非特权用户构成重大安全威胁。 此概念验证代码仅用于教育和研究目的。 在编写本文时，社区中尚无该漏洞的公开 PoC。因此，我决定负责任地分享此实现，以填补这一空白，为安全研究生态系统做出贡献，并提高人们对不安全文件系统关键性质的认识。 漏洞成因 概念验证 在攻击者机器上： 1- git clon...

CVE-2025-27591

CVE-2025-27591 – belowにおけるシンボリックリンク悪用による権限昇格 🛑 免責事項 : このエクスプロイトは教育目的および許可されたセキュリティテストのみ のために提供されています。無断使用は違法となる可能性があります。 🧠 概要 below は Facebook が開発した Linux システム向けのパフォーマンス監視ツールです。パッチ適用前のバージョンの below は、全ユーザー書き込み可能なログディレクトリ と未サニタイズのログ処理を悪用することで、非特権ユーザー が root に昇格できる重大な脆弱性の影響を受けます。 🔎 CVE 詳細 フィールド| 値...

CVE-2024-28589

CVE-2024-28589 Una vulnerabilità è stata scoperta in Axigen Mail Server per Windows, che interessa tutte le versioni fino alla 10.5.18 e consente l'escalation locale dei privilegi. Descrizione: È stato riscontrato che Axigen Mail Server è vulnerabile a un'escalation locale dei privilegi a causa d...

CVE-2025-27591

CVE-2025-27591 Below v0.9.0 PoC-Exploit zur Privilegienerweiterung Haftungsausschluss Dieser Exploit ist ausschließlich für Bildungszwecke gedacht. Er wurde entwickelt, um Benutzern zu helfen, Sicherheitsschwachstellen zu verstehen und ihr Wissen über Cybersicherheit zu verbessern. Der Autor...

CVE-2024-34474

CVE-2024-34474 Clario fino al 2024-04-11 per Windows Desktop ha permessi deboli per %PROGRAMDATA%\Clario e tenta di caricare DLL da lì come SYSTEM. Descrizione: L'applicazione desktop Clario per Windows tenta di caricare librerie DLL inesistenti da C:\ProgramData\Clario\ e...

CVE-2025-70341

CVE-2025-70341: Permissões Inseguras + Execução Arbitrária de Código no App-Auto-Patch Resumo O App-Auto-Patch v3.4.2 cria seu diretório de trabalho com permissões graváveis por qualquer usuário chmod 777, possibilitando uma condição de corrida TOCTOU time-of-check-time-of-use local. Um atacante...

CVE-2026-14875

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable directory...

AZL-96609 CVE-2026-73585 affecting package sblim-cmpi-base 1.6.4-17

A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during scri...

PYSEC-2026-873 OpenStack Nova live snapshots use an insecure local directory

OpenStack Compute Nova Grizzly 2013.1.4, Havana 2013.2.1, and earlier uses world-writable and world-readable permissions for the temporary directory used to store live snapshots, which allows local users to read and modify live snapshots...

Incorrect Permission Assignment for Critical Resource

Overview Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the ServeCreateOrUpdatePlaylist process. An attacker can overwrite or create arbitrary files on the host system by supplying a crafted playlist ID that resolves to an...

Creation of Temporary File in Directory with Insecure Permissions

Overview @earendil-works/pi-coding-agent is a Coding agent CLI with read, bash, edit, write tools and session management Affected versions of this package are vulnerable to Creation of Temporary File in Directory with Insecure Permissions in the process handling temporary extension package instal...

CVE-2026-34354

Akamai Guardicore Platform Agent GPA and Zero Trust Client on Linux and macOS allow TOCTOU-based local privilege escalation. The GPA service creates an IPC socket in the world-writable /tmp directory. It accepts unauthenticated IPC control messages. This enables a TOCTOU vulnerability in the...