wphardening

WPHardening Fortalezca la seguridad de cualquier instalación de WordPress. ❮ NOTA ❯ Esta herramienta publica nuevas versiones de forma regular. Asegúrese de actualizar sus dependencias con frecuencia para obtener la última versión. Consulte el registro de cambios o CHANGELOG.md para conocer las...

CVE-2022-0997

Fidelis Network and Deception - CVE-2022-0997 - Insecure File Permissions Privilege Escalation Releasability and Acknowledgements The exploit was approved for public release by the United States Government. Special thanks to the servicemen and government liaisons tasked with approving the...

linux-basics-for-hackers-notes

Linux Basics for Hackers — Course A structured course built from personal study notes of the book Linux Basics for Hackers by OccupyTheWeb. Each module breaks down the core concepts, commands, and practical examples in plain English — straightforward enough for beginners, detailed enough to...

CVE-2025-2502

Discovered by chance while learning about local privilege escalation. In any version of Lenovo PC Manager, the tools in Lenovo PC Manager have permission flaws. Any downloaded tool grants ordinary users F full control permissions. Since tools in all versions have permission issues, ordinary users...

CVE-2026-107332

Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files. To mitigate this issue, users should upgrade to version 4.10.0 or later...

CVE-2026-107332

The AWS Toolkit for Visual Studio Code contains insecure file permissions in the CodeCatalyst connection handler in versions prior to 4.10.0 . This vulnerability allows local users to obtain CodeCatalyst bearer tokens by reading world-readable token cache files. To remediate this issue, users sho...

EUVD-2026-95128

Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files. To mitigate this issue, users should upgrade to version 4.10.0 or later...

CVE-2021-4034

CVE-2021-4034 Exploit Usage $ git clone https://github.com/Anonymous-Family/CVE-2021-4034.git $ cd CVE-2021-4034 $ make ! CVE-2021-4034 Exploit By whokilleddb ! Initializing Setup + Setup Done :D ! Setting Root Privileges ! Launching Root Shell /bin/whoami root Rough Patch chmod 0755 which pkexec...

EUVD-2026-94855

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's data. The installer created the data, log, temp, database and event folders and the hMailServer.INI configuration file with the...

CVE-2025-57392

CVE-2025-57392 🔒 Security Vulnerability Report Product: BenimPOS Desktop V3.0 Vulnerability Type: Insecure File Permissions Affected Components: BenimPOS.exe, unins000.exe, System.Data.SQLite.dll Vulnerability Class: CWE-276: Incorrect Default Permissions Proof of Concept by: Fatih Bülbül Test...

AlmaLinux 9.2 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc (ALMALINUX9.2:CLSA-2026:1791359868)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791359868 advisory. - The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replac...

ansible-mysql-cve-2016-6662

ansible-mysql-cve-2016-6662 Simple ansible playbook to patch mysql servers against CVE-2016-6662. UPDATE 20160915.2347.CEST: Kenny informed me of Patrick Forsberg's catch that the original patch did not safeguard against ../ abuse. I've now replaced the patch with one that is more stringent based...

CVE-2022-3328

CVE-2022-3328 CVE-2022-3328 with CVE-2022-41974 and CVE-2022-41973 from: https://www.qualys.com/2022/11/30/cve-2022-3328/advisory-snap.txt https://blog.qualys.com/vulnerabilities-threat-research/2022/11/30/race-condition-in-snap-confines-mustmkdirandopenwithperms-cve-2022-3328...

Astra Linux – Vulnerability in Zabbix

During Zabbix installation from RPM, the DACOVERRIDE SELinux capability is used to access PID files in the /var/run/zabbix folder. In this case, processes of Zabbix Proxy or Server can bypass the file read, write, and execute permission checks at the file system level...

CVE-2022-0847-Docker

Dirty Pipe CVE-2022-0847: A Hands-On Exploit Demonstration in Docker This repository provides a self-contained, interactive Docker environment to safely demonstrate and analyze the "Dirty Pipe" privilege escalation vulnerability. It is designed as an educational tool for security professionals to...

CVE-2022-0486

Fidelis Network and Deception - CVE-2022-0486 - Escalación de Privilegios por Permisos de Archivo Inseguros - Múltiples Publicación y Agradecimientos Todos los exploits fueron aprobados para su divulgación pública por el Gobierno de los Estados Unidos. Un agradecimiento especial al personal milit...

CVE-2025-27581

CVE-2025-27581 Exploit scripts for CVE-2025-27581 BasicExploit.sh This just points the exploit to a file of your choice, it should set your target file to 0666 permissions but it can fail on certain files depending on applocker policies or selinux. CreateFakeRoot.sh This points the exploit to...

Mohnad-AL-saif-CVE-2020-11107-XAMPP-Local-Privilege-Escalation

🧨 CVE-2020-11107 – XAMPP Local Privilege Escalation Windows 📌 Overview CVE-2020-11107 is a Local Privilege Escalation LPE vulnerability affecting Apache Friends XAMPP on Windows. An unprivileged user can modify the XAMPP Control Panel configuration file xampp-control.ini and replace the default...

CVE-2023-46870

CVE-2023-46870 Las versiones 3.0.0, 3.1.0, 4.0.0, 4.1.0 y 4.1.1 del Nordic Semiconductor nRF Sniffer for Bluetooth LE tienen permisos de archivo incorrectos establecidos, lo que permite a adversarios realizar escalada de privilegios y ejecución de código modificando scripts bash y python. Palabra...

Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_2422)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20262422 advisory. nodejs: Nodejs filesystem permissions bypass CVE-2025-55132 nodejs: Nodejs denial of service CVE-2026-21637 nodejs: Nodejs denial of service CVE-2025-59466...