1022 matches found
wildpwn
First things first! Read: https://www.exploit-db.com/papers/33930/ Basic usage It goes something like this: usage: wildpwn.py -h --file FILE payload folder Tool to generate unix wildcard attacks positional arguments: payload Payload to use: combined | tar | rsync folder Where to write the payload...
CVE-2021-4034
CVE-2021-4034 PoC for PwnKit: Local Privilege Escalation Vulnerability in polkit’s pkexec in Python Usage git clone https://github.com/rvizx/CVE-2021-4034 cd CVE-2021-4034 python3 cve-2021-4034-poc.py Notes C : https://github.com/arthepsy/CVE-2021-4034 Fix sudo chmod 0755 /bin/pkexec...
CVE-2025-27591-Meta-below-LPE
CVE-2025-27591 — Meta below Symlink Local Privilege Escalation Overview Field| Details ---|--- CVE| CVE-2025-27591 Software| Meta below system resource monitor Affected Versions| 0.9.0 Vulnerability| Symlink following → arbitrary file overwrite as root Authentication| Local user with sudo access ...
FileGator < 7.14.2 - Privilege Escalation
FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod' function through 'octdec' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root. id:...
kernel: smb: client: validate dacloffset before building DACL pointers
A flaw was found in the Linux kernel's Server Message Block SMB client. A malicious server can exploit this vulnerability on 32-bit systems by providing a crafted dacloffset value. This can cause a pointer wrap, leading to the dereferencing of invalid Discretionary Access Control List DACL fields...
Security update for fuse-overlayfs
This update for fuse-overlayfs fixes the following issue: CVE-2026-77478: chmod on a hardlinked lower-layer file is silently dropped in the built image bsc1286378. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch...
rsync: Fix of 2 CVEs
CVE-2026-29518: re-implement the "use chroot = no" confinement after the centos7els fix: every path operation proves its parent directory beneath the pinned module root through /proc/self/fd and runs on it with the at calls. In-module symlinks, directories the daemon uid may search but not read,...
Security update for fuse-overlayfs
This update for fuse-overlayfs fixes the following issue: CVE-2026-77478: chmod on a hardlinked lower-layer file is silently dropped in the built image bsc1286378. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch...
OPENSUSE-SU-2026:22234-1 Security update for fuse-overlayfs
This update for fuse-overlayfs fixes the following issue: - CVE-2026-77478: chmod on a hardlinked lower-layer file is silently dropped in the built image bsc1286378...
Security update for fuse-overlayfs
This update for fuse-overlayfs fixes the following issue: CVE-2026-77478: chmod on a hardlinked lower-layer file is silently dropped in the built image bsc1286378. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch...
CVE-2026-119336 Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory...
CVE-2026-119336 Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory...
Filelock: UnixFileLock Truncates And Chmods Any Regular File Another User Renames Or Hard-links Onto The Lock Path
"UnixFileLock", the backend of "FileLock" and "AsyncFileLock" on Unix, empties whatever regular file it finds at the lock path once it holds the "flock" a kernel lock on an open file. With an explicit "mode" it also chmods that file sets its permission bits, whether or not this acquire created it...
GHSA-69HJ-F68J-2879 filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path
UnixFileLock, the backend of FileLock and AsyncFileLock on Unix, empties whatever regular file it finds at the lock path once it holds the flock a kernel lock on an open file. With an explicit mode it also chmods that file sets its permission bits, whether or not this acquire created it. Another...
filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path
UnixFileLock, the backend of FileLock and AsyncFileLock on Unix, empties whatever regular file it finds at the lock path once it holds the flock a kernel lock on an open file. With an explicit mode it also chmods that file sets its permission bits, whether or not this acquire created it. Another...
CLSA-2026-1792794952 python3.9: Fix of CVE-2026-12345
CVE-2026-12345: fix symlink race in tempfile.TemporaryDirectory cleanup that could delete or chmod files outside the temporary directory...
Virtualenv: Deletion Recovery Can Change A Symlink Target's Mode
Summary The deletion error handler obtains permission bits with lstat but applies them through chmod, which follows symlinks. On an eligible unlink failure this can change permissions outside the destination. Anthropic's OSS Scanner reported this as "ANT-2026-UK90QC27" in "virtualenv-20261015-005...
GHSA-43MP-35Q3-X3FQ virtualenv: Deletion recovery can change a symlink target's mode
Summary The deletion error handler obtains permission bits with lstat but applies them through chmod, which follows symlinks. On an eligible unlink failure this can change permissions outside the destination. Anthropic's OSS Scanner reported this as ANT-2026-UK90QC27 in virtualenv-20261015-005,...
virtualenv: Deletion recovery can change a symlink target's mode
Summary The deletion error handler obtains permission bits with lstat but applies them through chmod, which follows symlinks. On an eligible unlink failure this can change permissions outside the destination. Anthropic's OSS Scanner reported this as ANT-2026-UK90QC27 in virtualenv-20261015-005,...
CVE-2026-114105
Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting...