disclosures

공개 이 저장소는 제가 발견한 보안 문제를 문서화한 것입니다. Linux용 Citrix 클라이언트가 syslog에 자격 증명을 유출함 Citrix Linux 클라이언트의 안전하지 않은 임시 ICA 파일 생성 CVE-2023-24486...

CVE-2021-30357_CheckPoint_SNX_VPN_PoC

CVE-2021-30357CheckPointSNXVPNPoC CheckPoint SNX VPN Linux 클라이언트를 통한 권한 있는 파일 읽기에 대한 개념 증명. 영향을 받는 버전 CheckPointVPNSNXLinux800007075.sh MD5 체크섬: 4372e9936e2dfb1d1ebcef3ed4dd7787 익스플로잇 익스플로잇을 수행하려면 -f 매개변수를 사용하여 모든 파일을 SNX 구성으로 로드하면 됩니다. 파일이 유효한 SNX 구성이 아닌 경우 오류가 발생하고 구문 오류를 표시하며, 문자열 종결자가 발견될 때까지...

CVE-2020-8248

CVE-2020-8248: Pulse Secure VPN Linux Client의 Zip 와일드카드 익스플로잇을 통한 권한 상승 루트 SUID 실행 파일인 pulsesvc에는 와일드카드“”를 사용해 zip 명령을 안전하지 않게 호출하는 “doupload” 함수가 있습니다. 사용자가 제어하는 폴더“/.pulsesecure/pulse/”에 특수하게 조작된 이름의 파일을 작성함으로써, 공격자는 와일드카드를 악용하여 “zip” 실행 파일에 사용자 정의 플래그를 전달할 수 있으며, 그 결과 코드 실행이 발생합니다. NVD 공개: 이...

CVE-2020-8250

CVE-2020-8250: Pulse Secure VPN Linux Client에서 명령 주입을 통한 권한 상승 루트 SUID 실행 파일인 pulsesvc에는 “doupload” 함수가 있으며, 이 함수는 “HOME” 환경 변수를 안전하지 않게 “system”에 전달합니다. 공격자는 “HOME” 변수에 특수 셸 문자예: “” 또는 “$”를 포함하도록 변경하여, “doupload”가 호출될 때 임의의 명령을 주입하고 권한을 root로 상승시킬 수 있습니다. NVD 공개: 이 취약점에 대한 NVD 공개 정보는 여기에서 확인할 수...

CVE-2020-8249

CVE-2020-8249: Pulse Secure VPN Linux 클라이언트의 버퍼 오버플로우 루트 SUID 실행 파일인 pulsesvc에는 안전하지 않게 "sprintf"를 호출하는 "doupload" 함수가 있으며, 이로 인해 버퍼 오버플로우가 발생할 수 있습니다. "sprintf"가 스택에 값을 쓰기 때문에, 충분히 큰 문자열이 전달되면 스택에 저장된 정상적인 반환 주소Return Address를 덮어쓸 수 있습니다. NVD 공개: 이 취약점에 대한 NVD 공개는 여기에서 확인할 수 있습니다. 요구 사항: 이 익스플로잇...

CVE-2026-19042 Command Injection in TeamViewer Desktop Client for Linux through Chat Link Handling

A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands in the context of the current user via a specially crafted URL sent through the out-of-session chat feature. Exploitation requires user...

CVE-2026-66152

A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root...

CVE-2026-66153

The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths...

CVE-2026-66153

The SonicWall NetExtender Linux client is vulnerable to an Improper Link Resolution Before File Access (CWE-59) vulnerability within the NEService auto-upgrade process . This flaw arises because the process insecurely handles temporary files, allowing an attacker to manipulate file paths . The vu...

CVE-2026-66152

A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root...

EUVD-2026-65747

A Path traversal vulnerability in OPSWAT tarball in the SonicWall NetExtender Linux client allows an attacker to write arbitrary file as root...

CVE-2026-66152

A Path traversal vulnerability exists in the SonicWall NetExtender Linux client file extractor component, specifically within the OPSWAT tarball . This flaw allows an attacker to write arbitrary files with root privileges by using special characters like ../ to access directories outside the inte...

CVE-2026-66152

A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root...

SonicWall NetExtender Linux Client Multiple Vulnerabilities

1 CVE-2026-66152 - SonicWall NetExtender arbitrary file write via path traversal vulnerabilityA Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root. CVSS Score: 8.8 CVSS Vector:...

CVE-2026-66152: Path Traversal: '\..\filename'

A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root...

CVE-2026-66153: Improper Link Resolution Before File Access

The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths...

[SECURITY] Fedora 44 Update: freeipa-4.13.2-1.fc44

IPA is an integrated solution to provide centrally managed Identity users, hosts, services, Authentication SSO, 2FA, and Authorization host access control, SELinux user roles, services. The solution provides features for further integration with Linux based clients SUDO, automount and integration...

openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Red Hat Enterprise Linux OpenSSH client versions

A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack ca...

openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Red Hat Enterprise Linux OpenSSH client versions

A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack ca...

openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Red Hat Enterprise Linux OpenSSH client versions

A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack ca...