Lucene search
+L

496 matches found

Kitploit
Kitploit
added 2026/09/14 3:57 p.m.6 views

CVE-2025-55188

CVE-2025-55188: 7-Zip Arbitrary File Write Proof-of-concept of CVE-2025-55188, an arbitrary file write in 7-Zip. Patched in version 25.01, released on August 3, 2025. Note: CVE-2025-55188 is different than CVE-2025-11001. The version that CVE-2025-11001 was patched in version 25.00 is still...

3.6CVSS7.4AI score0.00692EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/14 11:09 a.m.17 views

CVE-2025-3464-AsIO3-LPE

CVE-2025-3464-AsIO3-LPE CVE-2025-3464: Exploit de escalación local sin privilegios para AsIO3.sys de ASUS - Bypass de autenticación TOCTOU + Decremento de PreviousMode CVE-2025-3464: Escalación de Privilegios Local en AsIO3.sys Este exploit solo funciona en Windows 11 22H2 o anterior. Microsoft...

8.4CVSS8.3AI score0.00584EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/13 11:11 p.m.9 views

CVE-2020-10665

CVE-2020-10665 Docker Desktop Local Privilege Escalation POC for Docker Desktop Local Privilege Escalation. Built based on the writeup at https://www.activecyber.us/activelabs/docker-desktop-local-privilege-escalation-cve-2020-10665. Hardlink creation adapted from...

7.2CVSS6.9AI score0.01435EPSS
SaveExploits2References1
OSV
OSV
added 2026/09/11 5:27 p.m.11 views

CVE-2026-87910 tarfile hardlink fallback ignores custom extraction filter rejection via None

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...

5.7CVSS5.7AI score
SaveExploits0References9
Vulnrichment
Vulnrichment
added 2026/09/11 5:27 p.m.8 views

CVE-2026-87910 tarfile hardlink fallback ignores custom extraction filter rejection via None

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...

5.7CVSS0.00423EPSS
SaveExploits0References3
CVE
CVE
added 2026/09/11 5:27 p.m.27 views

CVE-2026-87910

CVE-2026-87910 affects Python's tarfile module. When extracting a hardlink on a system without link support, tarfile falls back to extracting the referenced member from the archive. During this fallback, the extraction filter function is invoked twice—once for the extracted member and once with t...

5.7CVSS0.00423EPSS
SaveExploits0References6
Kitploit
Kitploit
added 2026/09/11 12:12 a.m.6 views

SharpPolarBear

SharpPolarBear 这是 SandboxEscaper 在此处(https://github.com/SandboxEscaper/polarbearrepo)发布的其中一个漏洞的武器化版本。 大部分代码来自 rasta-mouse 的 CollectorService 仓库(https://github.com/rasta-mouse/CollectorService)。我只是将原始 SandboxEscaper C++ 代码中的 CVE-2019-0841 漏洞代码改为了 C,并添加了一些检查。 我还加入了所需的二进制文件(schtasks.exe、schedsvc.dll...

7.8CVSS7.2AI score0.414EPSS
SaveExploits20References2
OSV
OSV
added 2026/09/11 12:11 a.m.7 views

RLSA-2026:61586 Moderate: tar security, bug fix, and enhancement update

The GNU tar program can save multiple files in an archive and restore files from an archive. Security Fixes: tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape CVE-2026-18477 tar: tar:...

5CVSS0.00401EPSS
SaveExploits1References5
Rockylinux
Rockylinux
added 2026/09/11 12:11 a.m.10 views

tar security, bug fix, and enhancement update

An update is available for tar. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The GNU tar program can save multiple files in an archive and restore files from...

5.5CVSS0.00401EPSS
SaveExploits1
Tenable Nessus
Tenable Nessus
added 2026/09/11 12:00 a.m.9 views

RockyLinux 10 : tar (RLSA-2026:61586)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:61586 advisory. tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path esca...

5.5CVSS0.00401EPSS
SaveExploits1References7
Kitploit
Kitploit
added 2026/09/10 7:36 a.m.6 views

research

Investigación de Seguridad Repositorio dedicado a mis descubrimientos de vulnerabilidades de seguridad CVEs. Este repositorio contiene documentación técnica detallada, exploits de prueba de concepto y análisis de las vulnerabilidades descubiertas. Acerca de Este repositorio agrupa todos los CVEs...

7CVSS7.2AI score0.00708EPSS
SaveExploits2References2
Kitploit
Kitploit
added 2026/09/09 9:03 p.m.11 views

CVE-2026-29786

CVE-2026-29786 Investigación: Joshua van Rijswijk Descripción Este repositorio contiene una Prueba de Concepto PoC para CVE-2026-29786 , una vulnerabilidad en el paquete npm tar que permite que un archivo manipulado cree un enlace duro hardlink que apunta fuera del directorio de extracción...

8.6CVSS6.4AI score0.00439EPSS
SaveExploits2References1
RedHat Linux
RedHat Linux
added 2026/09/08 4:09 a.m.6 views

python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory

A flaw was found in the tarfile.extractall function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside th...

7.8CVSS5.9AI score0.0075EPSS
SaveExploits0References7
RedHat Linux
RedHat Linux
added 2026/09/08 4:06 a.m.7 views

python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory

A flaw was found in the tarfile.extractall function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside th...

7.8CVSS0.0075EPSS
SaveExploits0References7
Kitploit
Kitploit
added 2026/09/07 6:40 p.m.9 views

CVE-2025-4517-POC

CVE-2025-4517 利用 说明 本利用及描述由AI编写。如果发现任何错误或问题,请告知我!本利用已测试并确认有效。感谢! 概述 本利用利用了 CVE-2025-4517 ,这是 Python tarfile 模块中的一个严重漏洞,通过组合符号链接路径遍历与硬链接操纵,可实现任意文件写入。该漏洞绕过了 Python 3.12 中引入的 filter="data" 保护机制。 漏洞详情 CVE ID : CVE-2025-4517 受影响版本 : Python 3.8.0 至 3.13.1 CVSS 评分 : 9.3(严重) 影响 : 以提升的权限进行任意文件写入 技术背景 该漏洞利...

9.4CVSS6.9AI score0.0143EPSS
SaveExploits11References4
RedHat Linux
RedHat Linux
added 2026/09/03 11:49 p.m.10 views

python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory

A flaw was found in the tarfile.extractall function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside th...

7.8CVSS6AI score0.0075EPSS
SaveExploits0References7
Tenable Nessus
Tenable Nessus
added 2026/09/03 12:00 a.m.9 views

Oracle Linux 10 : ELSA-2026-61586-0: / tar (ELSA-2026-615860)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-615860 advisory. - Backport upstream patches for CVE-2026-18477, fixes a bug where incremental restore with cyclic renames between backups may create a temporary...

5.5CVSS6.2AI score0.0045EPSS
SaveExploits2References4
RedHat Linux
RedHat Linux
added 2026/09/02 7:19 p.m.5 views

python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory

A flaw was found in the tarfile.extractall function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside th...

7.8CVSS6AI score0.0075EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/09/02 2:35 p.m.11 views

EUVD-2026-67077

NLTK: Downloader.download follows hardlinks and overwrites outside-root files...

7.1CVSS5.8AI score0.00135EPSS
SaveExploits1References7
OSV
OSV
added 2026/09/02 2:35 p.m.6 views

GHSA-F794-5JV7-7672 NLTK: Downloader.download follows hardlinks and overwrites outside-root files

Summary NLTK's downloader now blocks symlink escapes during ZIP extraction, but it still treats pre-existing hardlinks inside the install tree as ordinary in-root files. A normal package install can therefore overwrite an outside-root inode through that hardlink. Details - Vulnerability type:...

7.1CVSS5.9AI score0.00135EPSS
SaveExploits1References8
Rows per page
Query Builder