LocalPotato_CVE-2023-21746

Windows에서 로컬 권한 상승LPE 취약점이 2022년 9월 9일 Andrea Pierini@decoderit와 Antonio Cocomazzi@splintercode에 의해 Microsoft에 보고되었습니다. 이 취약점은 호스트에 낮은 권한 계정을 가진 공격자가 SYSTEM 권한으로 임의 파일을 읽고 쓸 수 있게 합니다. 취약점 자체만으로는 SYSTEM으로 명령을 직접 실행할 수 없지만, 여러 벡터를 결합하여 이를 달성할 수 있습니다. 편리하게도, 2023년 2월 13일 BlackArrowSec이 StorSvc 서비스를...

NamedPipePTH

NamedPipePTH 이 프로젝트는 로컬 네임드 파이프 사용자 가장Impersonation에서 인증을 위해 Pass-the-Hash를 사용하는 PoC 코드입니다. 설명하는 블로그 포스트도 있습니다: https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/ 이 코드는 Invoke-SMBExec.ps1 및 RoguePotato 프로젝트의 코드를 기반으로 합니다. 저는 과거에 특정 Offensive Security 프로젝트 상황에 직면했었는데, 이미 낮은 권한 사용자 계정의 NTLM 해시를 가지고...

Kernel-Chaos-Weaponizing-CVE-2025-62215-for-SYSTEM-Privilege-Escalation

Kernel-Chaos-Weaponizing-CVE-2025-62215-for-SYSTEM-Privilege-Escalation CVE‑2025‑62215에 대한 실습 분석: 실제 환경에서 악용된 Windows 커널 경쟁 조건 취약점. SYSTEM 권한 상승, 탐지 스크립트, 패치 검증 전략을 기업 방어자와 레드팀을 위해 시연합니다. CVE 2025 62215 – Windows 커널 권한 상승 익스플로잇 요약 CVE‑2025‑62215는 인증된 Windows 커널 익스플로잇으로, 메모리 핸들러의 경쟁 조건을 악용해 공격자가...

Astra Linux – Vulnerability in Mariadb 10.3

MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected MariaDB installations. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL...

CVE-2026-84226

OpenVPN version 2.5.0 through 2.6.22 and 2.7alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting attack during network configuration steps...

EUVD-2026-72276

An incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7alpha1 through 2.7.6 allows local authenticated users to cause memory corruption or disclose sensitive information via crafted NRPT inputs...

PT-2026-86639

The Windows Interactive Service in OpenVPN 2.7 alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via specially crafted paths...

CVE-2026-63649

The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via crafted options that bypass whitelist checks...

CVE-2026-18509

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege escalation via the Navigator for i debugger. This could allow the attacker to access or manipulate sensitive data on the system, or create new profiles with elevated privileges on the IBM i system...

CVE-2026-12036

An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file deletion with elevated privileges...

CVE-2026-63423

During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges...

CVE-2026-12504 Loytec LINX firmware: Improper Authentication in PAM configuration

Improper Authentication CWE-287 in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an /etc/passwd entry with an emp...

CVE-2026-15616 Local MFA not enforced during SSO sign-in

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access...

EUVD-2026-47258

Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Production...

EulerOS Virtualization 2.10.0 : cups (EulerOS-SA-2026-2846)

According to the versions of the cups package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in ...

CVE-2026-8919

Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application’s local service endpoint. This can result in...

CVE-2026-33802 Junos OS: EX Series: Unauthorized users can execute service-impacting CLI command

A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS on EX Series allows a local, authenticated attacker to cause a Denial-of-Service DoS. On EX2300, EX4000, EX4100, EX4300-MP Multigigabit and EX4400 switches, an authenticated, local attacker with no specific permissions ...

EUVD-2026-42690

A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally authenticated user to perform actions as the root user...

CVE-2026-0276

A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally authenticated user to perform actions as the root user...

CVE-2026-0276 Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability

A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally authenticated user to perform actions as the root user...