CVE-2020-5752

CVE-2020-5752: Druva inSync 本地权限提升 一个基于C的漏洞利用程序，针对Druva inSync Windows客户端（v6.6.3及以下版本） 。该应用程序在端口6064上暴露了一个RPC服务，该服务存在通过路径遍历导致的命令注入漏洞。这使得本地用户可以以NT AUTHORITY\SYSTEM权限执行任意命令。 漏洞详情 CVE: 2020-5752 测试环境: Windows 10 x64 权限级别: 本地权限提升 LPE 用法 1. 编译 使用gcc（MinGW）编译源代码： root@kitploit: gcc exploit.c -o...

CVE-2020-5752-Druva-inSync-Windows-Client-6.6.3---Local-Privilege-Escalation-PowerShell-

CVE-2020-5752: Druva-inSync-Windows-Client-6.6.3---本地权限提升-PowerShell- Druva inSync Windows Client 6.6.3 - 本地权限提升 PowerShell 修改后可使用系统权限获取 Reverse Shell。...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the lack of checking the InSync flag when reading bitmap pages. This vulnerability may lead to th...

Exploit for Path Traversal in Druva Insync_Client

CVE-2020-5752: Druva inSync Local Privilege Escalation A C-ba...

EUVD-2020-26955

Malware in sbrugna...

EUVD-2019-13608

Malware in sbrugna...

EUVD-2019-13607

Malware in sbrugna...

EUVD-2021-23263

Malware in sbrugna...

EUVD-2021-23264

Malware in sbrugna...

CVE-2021-36668

URL injection in Driva inSync 6.9.0 for MacOS, allows attackers to force a visit to an arbitrary url via the port parameter to the Electron App...

CVE-2021-36667

Command injection vulnerability in Druva inSync 6.9.0 for MacOS, allows attackers to execute arbitrary commands via crafted payload to the local HTTP server due to un-sanitized call to the python os.system library...

CVE-2020-5752

Relative path traversal in Druva inSync Windows Client 6.6.3 allows a local, unauthenticated attacker to execute arbitrary operating system commands with SYSTEM privileges...

CVE-2020-5798

inSync Client installer for macOS versions v6.8.0 and prior could allow an attacker to gain privileges of a root user from a lower privileged user due to improper integrity checks and directory permissions...

CVE-2019-4001

Improper input validation in Druva inSync Client 6.5.0 allows a local, authenticated attacker to execute arbitrary NodeJS code...

CVE-2019-3999

Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, unauthenticated attacker to execute arbitrary operating system commands with SYSTEM privileges...

CVE-2019-4000

Improper neutralization of directives in dynamically evaluated code in Druva inSync Mac OS Client 6.5.0 allows a local, authenticated attacker to execute arbitrary Python expressions with root privileges...

CVE-2021-36668

URL injection in Driva inSync 6.9.0 for MacOS, allows attackers to force a visit to an arbitrary url via the port parameter to the Electron App...

CVE-2021-36667

Command injection vulnerability in Druva inSync 6.9.0 for MacOS, allows attackers to execute arbitrary commands via crafted payload to the local HTTP server due to un-sanitized call to the python os.system library...

CVE-2021-36667

Command injection vulnerability in Druva inSync 6.9.0 for MacOS, allows attackers to execute arbitrary commands via crafted payload to the local HTTP server due to un-sanitized call to the python os.system library...

CVE-2021-36668

URL injection in Driva inSync 6.9.0 for MacOS, allows attackers to force a visit to an arbitrary url via the port parameter to the Electron App...