wildpwn

First things first! Read: https://www.exploit-db.com/papers/33930/ Basic usage It goes something like this: usage: wildpwn.py -h --file FILE payload folder Tool to generate unix wildcard attacks positional arguments: payload Payload to use: combined | tar | rsync folder Where to write the payload...

FileGator < 7.14.2 - Privilege Escalation

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod' function through 'octdec' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root. id:...

CVE-2025-27591-Meta-below-LPE

CVE-2025-27591 — Meta below Symlink Local Privilege Escalation Overview Field| Details ---|--- CVE| CVE-2025-27591 Software| Meta below system resource monitor Affected Versions| 0.9.0 Vulnerability| Symlink following → arbitrary file overwrite as root Authentication| Local user with sudo access ...

virtualenv: Deletion recovery can change a symlink target's mode

Summary The deletion error handler obtains permission bits with lstat but applies them through chmod, which follows symlinks. On an eligible unlink failure this can change permissions outside the destination. Anthropic's OSS Scanner reported this as ANT-2026-UK90QC27 in virtualenv-20261015-005,...

GHSA-43MP-35Q3-X3FQ virtualenv: Deletion recovery can change a symlink target's mode

Summary The deletion error handler obtains permission bits with lstat but applies them through chmod, which follows symlinks. On an eligible unlink failure this can change permissions outside the destination. Anthropic's OSS Scanner reported this as ANT-2026-UK90QC27 in virtualenv-20261015-005,...

CVE-2026-114105

Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting...

CVE-2026-112909 filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path

filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive hard-link policy; when an explicit mode is requested, affected...

CVE-2026-112909

The filelock Python library contains a vulnerability in UnixFileLock prior to version 4.2.1 . A local user can cause the library to truncate or change the mode of a regular file if that file is renamed or hard-linked onto the lock path by another user (who has rename permissions or a permissive h...

CVE-2026-112909 filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path

filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive hard-link policy; when an explicit mode is requested, affected...

CentOS Linux 6 [TuxCare] Security Update: rsync (CENTOS6:CLSA-2026:1791908277)

The CentOS Linux 6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1791908277 advisory. - Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename...

Siemens SIMATIC S7-1500 TM MFP Out-of-bounds Write (CVE-2026-46195)

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate dacloffset before building DACL pointers parsesecdesc, buildsecdesc, and the chown path in idmodetocifsacl all add the server-supplied dacloffset to pntsd before proving a DACL header fits inside the returne...

CVE-2021-4034

CVE-2021-4034 PoC for PwnKit: Local Privilege Escalation Vulnerability in polkit’s pkexec in Python Usage git clone https://github.com/rvizx/CVE-2021-4034 cd CVE-2021-4034 python3 cve-2021-4034-poc.py Notes C : https://github.com/arthepsy/CVE-2021-4034 Fix sudo chmod 0755 /bin/pkexec...

EUVD-2026-90788

A flaw was found in ansible-runner. The unstreamdir function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/worker protocol, re-creates symbolic links from archive content without validating the link target and applies chmod and utime to an...

Rocky Linux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync (ALMALINUX9.6:CLSA-2026:1779959867)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779959867 advisory. - Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes,...

AlmaLinux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync (ALMALINUX9.6:CLSA-2026:1779959867)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779959867 advisory. - Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes,...

AlmaLinux 9.2 [TuxCare] Security Update: rsync / rsync-daemon (ALMALINUX9.2:CLSA-2026:1780486587)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780486587 advisory. - Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes,...

Rocky Linux 8 [CIQ] Security Update: python3-rpm / python3-rpm-debuginfo / rpm / rpm-apidocs / rpm-build / etc Multiple Vulnerabilities (crlsa-2024_0647)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20240647 advisory. rpm: TOCTOU race in checks for unsafe symlinks CVE-2021-35937 rpm: races with chown/chmod/capabilities calls during installation CVE-2021-35938 rpm: checks...

AlmaLinux 9.2 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (ALMALINUX9.2:CLSA-2024:1734531954)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1734531954 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when...

Rocky Linux 8 [CIQ] Security Update: cups / cups-client / cups-client-debuginfo / cups-debuginfo / etc (crlsa-2024_4265)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20244265 advisory. cups: Cupsd Listen arbitrary chmod 0140777 CVE-2024-35235 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...

CentOS Linux 7 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (CENTOS7:CLSA-2025:1762544838)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1762544838 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starti...