-Linux-PrivEsc-CVE-2024-48990

Privesc-need-restart-2024-48990 Описание эксплойта CVE-2024-48990 - Pure Python Этот скрипт эксплуатирует уязвимость CVE-2024-48990 в утилите needrestart Linux путем перехвата пути библиотек PYTHONPATH hijacking. В отличие от исходного вектора, этот метод использует исключительно Python, что...

PinTheft-go

pintheft-go pintheft の Go 移植版 - RDS zcopy double-free LPE。Dirty Frag 脆弱性クラスに属します。 !IMPORTANT Arch Linux は、この脆弱性に対して最も露出しているディストリビューションの一つです。RDS モジュールをデフォルトでロードできる数少ないディストリビューションの一つだからです。 動作原理（tl;dr） バグは rdsmessagezcopyfromuser にあります。この関数は FOLLGET を使用してユーザーページを1つずつ GUP...

CVE-2026-78408 Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve. Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an...

EUVD-2026-70105

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve. Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an...

CVE-2026-78408

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve. Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an...

CVE-2026-78408

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve. Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an...

CVE-2026-78408 Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve. Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an...

CVE-2026-78408

util-linux nsenter --join-cgroup opens the target cgroup.procs file as root and leaves the file descriptor open across subsequent namespace, credential, and execve() transitions. Because the kernel evaluates later cgroup migrations against the credentials of the original open, a process in an att...

CVE-2026-43284

🚨 CVE-2026-43284 — Dirty Frag 🚨 Универсальное локальное повышение привилегий в ядре Linux Обзор Поле| Детали ---|--- CVE| CVE-2026-43284 xfrm/ESP + CVE-2026-43500 RxRPC Псевдоним| Dirty Frag CVSS| 7.8 HIGH Тип| Локальное повышение привилегий LPE Введено| Ядро Linux 4.10 2017, коммит cac2661c53f3...

CVE-2023-30253-exploit

CVE-2023-30253 — Dolibarr ERP/CRM 17.0.0 Удаленное выполнение кода Эксплойт PHP-инъекции для Dolibarr ERP/CRM v17.0.0 , позволяющий получить обратную оболочку от пользователя www-data через модуль Website/CMS. ⚠️ Только для образовательных целей и аудита с разрешения. 📑 Содержание Что такое...

CVE-2026-33317

CVE-2026-33317 OP-TEE PKCS11 PoC 이 저장소에는 CVE-2026-33317 / GHSA-8cqw-mg7v-c9p9에 대한 Normal World 개념 증명PoC, 재현 메모, 캡처된 로그가 포함되어 있습니다. 공식 OP-TEE 권고는 PKCS11CMDGETATTRIBUTEVALUE에 대한 entrygetattributevalue에서 누락된 검증을 설명합니다. 이 버그는 PKCS11 TA 힙에서 경계를 벗어난 읽기를 유발할 수 있으며, 잘못된 형식의 속성 템플릿을 사용하면 임시 템플릿 버퍼를 넘어 쓰기가...

ida-cli

ida-cli macOS 및 Linux에서 바이너리 분석을 위한 헤드리스 IDA CLI 및 스킬 우선skill-first 툴킷. ida-cli는 런타임 백엔드를 자동 선택하고, 필요 시 로컬 서버를 자동 시작하며, 플랫 CLI, stdio MCP 전송transport, Streamable HTTP MCP 전송transport으로 동일한 표면surface을 노출합니다. 中文说明 두 가지 사용자용 진입점 로컬 ida-cli 바이너리단일 실행 파일에 클라이언트 + 서비스 포함 에이전트 환경용으로 설치 가능한 ida-cli...

CVE-2025-24893

CVE-2025-24893 Эксплойт удаленного выполнения кода RCE в XWiki Эксплойт на Python3 для CVE-2025-24893 , критической уязвимости неаутентифицированного удаленного выполнения кода RCE, затрагивающей платформу XWiki. Этот скрипт эксплуатирует уязвимость инъекции кода/выражения CWE-95 в компоненте...

Security update for texlive

This update for texlive fixes the following issue: CVE-2026-63729: heap use-after-free in the SyncTeX parser can lead to application crash or arbitrary code execution when malformed .synctex or .synctex.gz files are processedbsc1272432. Patch Instructions: To install this SUSE update use the SUSE...

kubescape v4.0.13

Kubescape Comprehensive Kubernetes Security from Development to Runtime Kubescape is an open-source Kubernetes security platform that pr...

CVE-2022-0847-Dirty-Pipe-

CVE-2022-0847-Dirty-Pipe- это репозиторий, связанный с проблемой повышения привилегий в Linux-системах, а также новости о проблеме «Dirty Pipeline» Макс Келлерманн, разработчик из CM4all немецкой компании веб-хостинга, обнаружил её в начале 2022 года, но не в ходе поиска уязвимостей. Он занимался...

Copy_Fail_CVE-2026-31431_test_and_fix

사용 방법 root@kitploit: python3 testCVE-2026-31431.py Almalinux 9 / 10용 수정 커널 업데이트가 도착할 때까지 root@kitploit: sudo grubby --update-kernel ALL --args="initcallblacklist=algifaeadinit" sudo reboot Debian / Ubuntu용 수정 커널 업데이트가 도착할 때까지 root@kitploit: root로 실행 echo "install algifaead /bin/false"...

CVE-2026-31431-Check

CVE-2026-31431 Copy Fail 취약점 점검 스크립트 취약점 개요 CVE-2026-31431 Copy Fail 은 Linux 커널 로컬 권한 상승 취약점으로, AFALG 소켓address family 38과 splice 제로카피 시스템 콜을 결합하여 파일 쓰기 권한을 우회하고 페이지 캐시page cache를 변조함으로써, 쓰기 권한이 없는 SUID 바이너리를 변조하여 root 권한을 획득합니다. 공격 체인 root@kitploit: socketAFALG, SOCKSEQPACKET, 0 AFALG 소켓 생성 -...

GHSA-9HJF-W35W-6VX2 elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

Summary The PHP connector's CSRF gate protects many mutating commands, but it does not protect the netmount connector command. In the shipped minimal connector setup, FTP network mounting is enabled by default, so a cross-site request can force an elFinder instance to mount an attacker-chosen FTP...

elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

Summary The PHP connector's CSRF gate protects many mutating commands, but it does not protect the netmount connector command. In the shipped minimal connector setup, FTP network mounting is enabled by default, so a cross-site request can force an elFinder instance to mount an attacker-chosen FTP...