disclosures

安全披露 这是记录我所遇到的安全问题的仓库。 Citrix Linux 客户端向 syslog 泄露凭据 Citrix Linux 客户端不安全的临时 ICA 文件创建 CVE-2023-24486...

CVE-2021-30357_CheckPoint_SNX_VPN_PoC

CVE-2021-30357CheckPointSNXVPNPoC 针对通过 CheckPoint SNX VPN Linux 客户端进行特权文件读取的概念验证（PoC）。 受影响版本 CheckPointVPNSNXLinux800007075.sh MD5 校验和：4372e9936e2dfb1d1ebcef3ed4dd7787 漏洞利用 要利用此漏洞，只需使用 -f 参数将任意文件作为 SNX 配置加载。如果该文件不是有效的 SNX 配置，程序将抛出错误并显示语法错误，从而泄露文件内容，直到找到字符串终止符（例如 etc/shadow）： $ /usr/bin/snx -f...

CVE-2020-8248

CVE-2020-8248: Pulse Secure VPN Linux客户端中通过Zip通配符利用的权限提升 root SUID可执行文件pulsesvc中的“doupload”函数不安全地调用了带有通配符（“”）的zip命令。通过以特定方式构造文件名，在用户控制文件夹（“/.pulsesecure/pulse/”）中写入文件，攻击者可以滥用通配符向“zip”可执行文件传递自定义标志，从而实现代码执行。 NVD披露： 此漏洞的NVD披露信息可在此查看。 要求： 该漏洞利用针对客户端认证后访问的代码，这意味着要利用此漏洞，攻击者需要满足以下三种场景之一： 托管一个攻击者控制的Pulse...

CVE-2020-8250

CVE-2020-8250：通过命令注入在 Pulse Secure VPN Linux 客户端中实现权限提升 root SUID 可执行文件 pulsesvc 中有一个名为“doupload”的函数，该函数会不安全地将“HOME”环境变量传递给“system”。通过将“HOME”变量修改为包含特殊 shell 字符（例如：“”或“$”），攻击者可以在调用“doupload”时注入任意命令，并将其权限提升至 root。 NVD 披露： 该漏洞的 NVD 披露可在此处查看。 要求： 该漏洞利用针对的是客户端认证后才会访问到的代码，这意味着要利用此漏洞，攻击者需要满足以下 3 种场景之一：...

CVE-2020-8249

CVE-2020-8249: Desbordamiento de búfer en Pulse Secure VPN Linux Client El ejecutable SUID root pulsesvc, tiene una función “doupload” que llama de forma insegura a “sprintf”, lo que puede resultar en un desbordamiento de búfer. Debido a que “sprintf” escribe los valores en la pila, si se le pasa...

CVE-2026-19042 Command Injection in TeamViewer Desktop Client for Linux through Chat Link Handling

A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands in the context of the current user via a specially crafted URL sent through the out-of-session chat feature. Exploitation requires user...

CVE-2026-66152

A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root...

CVE-2026-66153

The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths...

CVE-2026-66153

The SonicWall NetExtender Linux client is vulnerable to an Improper Link Resolution Before File Access (CWE-59) vulnerability within the NEService auto-upgrade process . This flaw arises because the process insecurely handles temporary files, allowing an attacker to manipulate file paths . The vu...

EUVD-2026-65747

A Path traversal vulnerability in OPSWAT tarball in the SonicWall NetExtender Linux client allows an attacker to write arbitrary file as root...

CVE-2026-66152

A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root...

CVE-2026-66152

A Path traversal vulnerability exists in the SonicWall NetExtender Linux client file extractor component, specifically within the OPSWAT tarball . This flaw allows an attacker to write arbitrary files with root privileges by using special characters like ../ to access directories outside the inte...

CVE-2026-66152

A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root...

SonicWall NetExtender Linux Client Multiple Vulnerabilities

1 CVE-2026-66152 - SonicWall NetExtender arbitrary file write via path traversal vulnerabilityA Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root. CVSS Score: 8.8 CVSS Vector:...

CVE-2026-66152: Path Traversal: '\..\filename'

A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root...

CVE-2026-66153: Improper Link Resolution Before File Access

The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths...

[SECURITY] Fedora 44 Update: freeipa-4.13.2-1.fc44

IPA is an integrated solution to provide centrally managed Identity users, hosts, services, Authentication SSO, 2FA, and Authorization host access control, SELinux user roles, services. The solution provides features for further integration with Linux based clients SUDO, automount and integration...

openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Red Hat Enterprise Linux OpenSSH client versions

A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack ca...

openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Red Hat Enterprise Linux OpenSSH client versions

A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack ca...

openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Red Hat Enterprise Linux OpenSSH client versions

A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack ca...