9237 matches found
CVE-2026-80917 PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
In the Linux kernel, the following vulnerability has been resolved: PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems On 32-bit systems the config space is too large to ioremap in one go, so pciecamcreate maps each bus segment separately and relies on the -addbus callback...
CVE-2021-3560-exploit
CVE-2021-3560 — Polkit 权限提升 CVE-2021-3560 是 Polkit （前身为 PolicyKit）中的一个本地权限提升漏洞，Polkit 是 Linux 桌面环境使用的授权框架。本地非特权攻击者可以利用 accounts-daemon D-Bus 接口中的竞态条件创建特权用户、设置其密码，并最终获得 root 访问权限。 工作原理 背景：Polkit + accounts-daemon accounts-daemon（org.freedesktop.Accounts）是一个系统 D-Bus 服务，负责管理用户帐户（创建、删除、密码更改等）。它暴露了以下方...
polkit-CVE-2021-3560_writeup
Try Hack Me - Polkit:CVE-2021-3560 作者: Atharva Bordavekar 难度: 信息 分数: 32 漏洞: CVE-2021-3560 我们将首先检查polkit的版本以获得更好的洞察。 root@kitploit: apt list --installed | grep policykit-1 policykit-1/focal,now 0.105-26ubuntu1 amd64 已安装,可升级至: 0.105-26ubuntu1.1 我使用deepseek创建了一个简单的类比，帮助你更好地理解polkit的概念。 夜店保安类比 夜店:...
RLSA-2026:65120 Important: redis:7 security update
Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, ...
redis:7 security update
An update is available for redis, module.redis. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Redis is an advanced key-value store. It is often referred to as ...
CVE-2022-34753-EXPLOIT
CVE-2022-34753 - SpaceLogic C-Bus Home Controller 中的 OS 命令注入 CVE-2022-34753 是一个严重的安全漏洞，归类为 CWE-78，表明“对 OS 命令中使用的特殊元素的不当中和”（通常称为 'OS 命令注入'）。此漏洞构成重大风险，因为如果受影响的命令被攻破，可能导致远程 root 利用。 受影响的产品 此漏洞影响以下产品： root@kitploit: 产品名称：SpaceLogic C-Bus Home Controller 5200WHC2 原名：C-Bus Wiser Home Controller MK2...
pack2theroot-lab
Pack2TheRoot 实验室 — CVE-2026-41651 一个基于 Docker 的 CTF 风格本地权限提升实验室，围绕 Pack2TheRoot 公告（CVE-2026-41651）构建，这是 PackageKit 守护进程中存在 12 年之久的漏洞，由德国电信红队于 2026 年 4 月 22 日 披露。 该实验室包含三个容器 ：一个宽松 polkit 的 CTF 挑战、一个加固后的对比目标，以及一个完整的 TOCTOU 漏洞利用复现 ，后者从源码构建存在漏洞的 PackageKit 并运行实际的 CVE-2026-41651 根因利用。 1. 包含内容 容器| 端口|...
glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...
glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...
glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...
glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...
glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...
glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...
glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...
glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...
CVE-2021-3560
PolicyKit CVE-2021-3560 Explotación Agente de autenticación Implementación en C de la explotación de CVE-2021-3560, publicaciones sobre esta explotación: https://ricterz.me/posts/2022-04-28-a-new-exploit-method-for-cve-2021-3560-polkit-linux-privilege-escalation.txt...
PT-2026-89087
In the Linux kernel, the following vulnerability has been resolved: PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems On 32-bit systems the config space is too large to ioremap in one go, so pci ecam create maps each bus segment separately and relies on the -add bus callback p...
kernel: wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses
A flaw was found in the Linux kernel. The mt7925 Wi-Fi driver incorrectly dispatches a memory-mapped I/O MMIO specific event to non-MMIO buses, such as USB. This improper handling leads to a NULL pointer dereference when attempting to clean up DMA transmit queues. A remote attacker could exploit...
redis: Redis: Denial of Service via Out-of-Bounds Read in Cluster Bus
An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial of service or information disclosure by sending a specially crafted PING message to the Redis Cluster Bus port...
Oracle Linux 10 : ELSA-2026-64799-0: / glib2 (ELSA-2026-647990)
The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-647990 advisory. - Fix CVE-2026-16118: heap-buffer-overflow in xdgmime byte-swap - Fix CVE-2026-15588: limit D-Bus auth line read length - Fix CVE-2026-58011: range validatio...