CVE-2024-37726-MSI-Center-Local-Privilege-Escalation

CVE-2024-37726 MSI Center Local Privilege Escalation - Arbitrary File Overwrite Vulnerability Vulnerability Summary A local privilege escalation vulnerability on Windows OS has been identified in MSI Center versions = 2.0.36.0, which allows a low-privileged user to arbitrarily overwrite or delete...

zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

Summary A critical architectural parser differential exists in the zip crate = 9.0.4 between random-access archive readers ZipArchive and streaming readers ZipStreamReader. ZipArchive considers the Central Directory File Header CDFH authoritative and ignores the filename declared in the Local Fil...

GHSA-M665-V7PM-7GRJ zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

Summary A critical architectural parser differential exists in the zip crate = 9.0.4 between random-access archive readers ZipArchive and streaming readers ZipStreamReader. ZipArchive considers the Central Directory File Header CDFH authoritative and ignores the filename declared in the Local Fil...

CVE-2024-37726-MSI-Center-Local-Privilege-Escalation

CVE-2024-37726 MSI Center Local Privilege Escalation - Arbitrary File Overwrite Vulnerability...

CVE-2026-103407 Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management

An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the...

CVE-2026-103407

The ConfigDirector component in Juniper Networks Session Smart Router and Session Smart Conductor is affected by an Improper Limitation of a Pathname to a Restricted Directory (CWE-22) vulnerability. An authenticated REST user can exploit this flaw via the certificate and private-key REST API to ...

security-research

Security Research A collection of files related to my personal security research. Additional content will be posted on my blog https://blog.mirch.io. Tools Tool| Description ---|--- openssldircheck| Windows utility to check for potential insecure paths used by the OPENSSLDIR build parameter in...

CVE-2022-43293

Exploits for CVE-2022-43293 To get a persistent Windows Denial of Service as shown in the POC above, simply run Exploit.bat and enter %windir%\system32\cng.sys when you're asked which file you want to overwrite. Here you can find my Arbitrary File Write\Overwrite Vulnerability report. Here you ca...

Dirty-Pipe-CVE-2022-0847

Dirty-Pipe-CVE-2022-0847 CVE-2022-0847 Dirty Pipe is an arbitrary file overwrite vulnerability that allows escalation of privileges by modifying or overwriting arbitrary read-only files e.g. /etc/passwd, /etc/shadow. Steps 1. Compile using gcc cve-2022-0847-exploit.c -o cve-2022-0847-exploit 2. R...

CVE-2019-1476

CVE-2019-1476 AppXSvc Arbitrary File Overwrite DoS I have independently reported this vulnerability to MSRC as part of my research inspired by CVE-2019-0841 originally reported by Nabeel Ahmed. This vulnerability allows a regular user to overwrite arbitrary files. However, the attacker's...

CVE-2026-23745

CVE-2026-23745: node-tar Arbitrary File Overwrite Research: Joshua van Rijswijk Description PoC for CVE-2026-23745 , a high-severity path traversal vulnerability in node-tar 7.5.2. The library fails to sanitize absolute paths in the linkpath field for Hardlinks and Symlinks. This allows malicious...

Cve-2025-8088-WinRar-vulnerability

Cve-2025-8088 WinRAR Python tool that creates a malicious RAR file to exploit the CVE-2025-8088 vulnerability in WinRAR. The CVE-2025-8088 vulnerability allows exploitation of manipulated RAR files to cause path traversal and overwrite arbitrary files on the victim's system. This project is for...

CVE-2026-21436

CVE-2026-21436 eopkg = 4.3.4, the Solus OS package manager, writes files containing absolute paths in package contents directly to the specified directory during the installation of packages with the .eopkg extension. Even if the --destdir parameter, used to install the package to a specific...

CVE-2026-93864

A link following vulnerability exists in the WatchGuard Fireware OS firewall daemon. A local attacker with code execution as a low-privileged system process can overwrite arbitrary files with root privileges and tamper with firewall IP set data. This is achieved by planting a crafted file system ...

CVE-2026-93864 Fireware OS Link Following in firewalld Allows Local Arbitrary File Overwrite as Root

A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP set data, by planting a crafted file system object and...

Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage

Summary The FileSessionManager defaults to storing session data in /tmp/strands/sessions/ a world-writable directory using predictable file paths and a write pattern openpath + ".tmp", "w" → os.replace that follows symbolic links. A local attacker can exploit this to overwrite arbitrary files or...

GHSA-3W55-933P-8PV5 Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage

Summary The FileSessionManager defaults to storing session data in /tmp/strands/sessions/ a world-writable directory using predictable file paths and a write pattern openpath + ".tmp", "w" → os.replace that follows symbolic links. A local attacker can exploit this to overwrite arbitrary files or...

Exploit for CVE-2026-115905

zip-cloaking-scanner Detection-only triage scanner for Rus...

RockyLinux 9 : lrzsz (RLSA-2026:89755)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:89755 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via...

CVE-2026-115908

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extractunwrappedrootdir use safepreparepath in src/read/zipfile.rs and simplifiedcomponents in src/path.rs to validate symbolic link targets with a lexical...