CVE-2026-80561

A flaw was found in the Linux kernel's libceph component. A malicious or compromised Object Storage Device OSD can exploit multiple unsafe decode operations within the decodelocker function. This can lead to slab-out-of-bounds reads, potentially allowing an attacker to disclose sensitive...

CVE-2026-80548

A flaw was found in the Linux kernel's s390/vfioccw component. The iomutex was not sufficiently expanded to serialize I/O operations, which could lead to race conditions. These race conditions could result in unexpected system behavior or instability...

CVE-2024-3094

CVE-2024-3094 CVE-2024-3094 ha esposto una backdoor nella libreria di compressione XZ, consentendo l'accesso SSH remoto eludendo l'autenticazione. Si tratta di un grave attacco alla supply chain che colpisce i sistemi Linux, evidenziando i rischi nei componenti open source fidati. La backdoor XZ:...

CVE-2022-0847-Docker

Dirty Pipe CVE-2022-0847: Dimostrazione Pratica di un Exploit in Docker Questo repository fornisce un ambiente Docker interattivo e autonomo per dimostrare e analizzare in sicurezza la vulnerabilità di escalation dei privilegi "Dirty Pipe". È progettato come strumento educativo per i professionis...

CVE-2026-80579

A flaw was found in the Linux kernel's fbdev component. A local user could exploit a use-after-free vulnerability by manipulating video modes. When a mode is deleted, the fbinfo-mode pointer might not be cleared, leading to a stale pointer dereference during subsequent system file system sysfs...

CVE-2026-80574

A flaw was found in the Linux kernel's focaltech input driver. This vulnerability occurs in the focaltechprocessrelpacket function, where incorrect handling of input can lead to an array out-of-bounds write. This memory corruption issue could potentially allow an attacker to cause system...

CVE-2026-80551

A flaw was found in the Linux kernel's s390/vfioccw component. This vulnerability arises because the system does not ensure that the address in the first Indirect Data Address Word IDAW remains constant between reads. An attacker could potentially exploit this to cause the system to operate with ...

nvidia-gpu-security-poc

NVIDIA GPU-Treiber — zwei Findings, die NVIDIA als erwartetes Verhalten geschlossen hat Proof-of-Concept-Code und rohe Beweise für zwei Findings im NVIDIA Linux GPU-Treiber, beide über NVIDIAs VDP gemeldet und beide von NVIDIA als beabsichtigt/erwartetes Verhalten geschlossen. Veröffentlicht, dam...

dirtyclone-CVE-2026-43503

CVE-2026-43503 — DirtyClone Scalata di privilegi locale su Linux. Un skbuff clonato perde il flag SKBFLSHAREDFRAG, quindi la decifratura ESP in-place scrive nella memoria della cache delle pagine supportata da file. Il PoC modifica /etc/passwd in cache per iniettare un account con uid 0 e fornisc...

CVE-2019-5489

CVE 2019-5489 इस रिपॉजिटरी में Linux के लिए Page Cache Side Channel Attacks CVE-2019-5489 का प्रूफ ऑफ कॉन्सेप्ट है। पेज कैश साइड चैनल का मूल्यांकन करने के लिए, मैंने दो प्रक्रियाओं के बीच कोवर्ट चैनल लागू किया है। सेंडर प्रक्रिया पेज कैश साइड चैनल के माध्यम से रिसीवर प्रक्रिया को गोपनीय डेटा भेजत...

CVE-2018-3639

CVE-2018-3639 Bypass speculativo del negozio CVE-2018-3639 proof of concept per Linux Scarica root@kitploit: git clone [email protected]:mmxsrup/CVE-2018-3639.git Compila root@kitploit: cd CVE-2018-3639 make Esegui root@kitploit: ./specter Output root@kitploit: $ ./spectre idx: 0, highest:P,...

Dirty-Pipe-Exploit

Dirty-Pipe-Exploit O exploit Dirty Pipe CVE-2022-0847 é uma vulnerabilidade do kernel Linux v5.8+ que permite a atacantes sem privilégios sobrescrever arquivos arbitrários por meio de uma falha no mecanismo de pipes. Isso leva à escalada de privilégios, concedendo acesso root. Semelhante ao Dirty...

metasploitable3

Metasploitable3 Metasploitable3 is a VM that is built from the ground up with a large amount of security vulnerabilities. It is intended to be used as a target for testing exploits with metasploit. Metasploitable3 is released under a BSD-style license. See COPYING for more details. Quick-start To...

CVE-2022-34918-LPE-PoC

CVE-2022-34918 LPE PoC Exploit LPE per CVE-2022-34918. Questo exploit è stato scritto per il kernel Linux ubuntu 5.15.0-39-generic Puoi trovare il relativo write-up sul nostro blog Utilizzo getroot dovrebbe trovarsi nella cartella corrente root@kitploit: $ ls getroot poc $ ./poc...

CVE-2022-34918-LPE-PoC

CVE-2022-34918 LPE PoC Exploit LPE per CVE-2022-34918. Questo exploit è stato scritto per il kernel Linux ubuntu 5.15.0-39-generic Puoi trovare l'analisi dettagliata sul nostro blog Utilizzo getroot deve trovarsi nella cartella corrente root@kitploit: $ ls getroot poc $ ./poc...

CVE-2020-8250

CVE-2020-8250: Elevazione dei Privilegi tramite Iniezione di Comandi nel Client Linux Pulse Secure VPN L'eseguibile SUID di root pulsesvc ha una funzione "doupload" che passa in modo non sicuro la variabile d'ambiente "HOME" a "system". Alterando la variabile "HOME" per contenere caratteri specia...

CVE-2020-8249

CVE-2020-8249: Estouro de Buffer no Pulse Secure VPN Linux Client O executável SUID root pulsesvc, tem uma função “doupload” que chama “sprintf” de forma insegura, o que pode resultar em um estouro de buffer. Como o “sprintf” escreve os valores na pilha, se uma string grande o suficiente for...

CVE-2020-8248

CVE-2020-8248: Elevazione dei privilegi tramite exploit di wildcard Zip nel client Linux Pulse Secure VPN L'eseguibile SUID root pulsesvc ha una funzione "doupload" che richiama in modo non sicuro un comando zip con wildcard "". Scrivendo file con nomi appositamente creati in una cartella...

Escalamiento-de-Privilegios-usando-el-Kernel-Exploit-Dirty-Cow

Escalata di Privilegi utilizzando il Kernel Exploit Dirty Cow Questo progetto ha lo scopo di dimostrare in modo pratico il funzionamento dell'exploit Dirty COW CVE-2016-5195, una vulnerabilità critica del kernel di Linux. Viene simulato uno scenario realistico in cui un attaccante con accesso...

kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer

A use-after-free vulnerability was found in the Linux kernel's IPv6 FIB rule lookup path. In fib6rulesuppress, when a route is suppressed and released via ip6rtputflags, the res-rt6 pointer is not cleared. If no later rule supplies a replacement route, fib6rulelookup returns the stale freed rt6in...