SELinux-Permissive-Only-CVE-2025-21479

SELinux-Permissive-Only-version-of-Cheese-aka-CVE-2025-21479 이것은 현재로서는 SELinux permissive 전용 버전으로, 삼성 스냅드래곤 기기를 포함한 많은 기기의 adreno kgsl에 영향을 미쳤던 CVE-2025-21479로도 알려진 Cheese 익스플로잇입니다. 다음 저장소의 일부 코드가 재사용되었습니다. 개념 증명을 처음 시작해 주신 zhuowei님과 유지 관리가 잘 되고 활발한 저장소를 유지해 주신 sarabpal-dev님께 감사드립니다...

CVE-2020-9442

익스플로잇 제목: OpenVPN Connect for Windows MSI - 3.1.0.361 - 권한 상승 날짜: 2020-02-28 작성자: Andrew Hess 소프트웨어 링크: https://openvpn.net/client-connect-vpn-for-windows/ 버전: 3.1.0.361 MSI CVE: CVE-2020-9442 이력 2019.12.15 - 취약점 발견 2019.12.15 - 공급업체에 최초 연락 2020.01.xx - 공급업체 패치 - 3.1.1 378 베타 3.1.1 378 베타 릴리스 노트 ...

aquos-r7-ghostlock

AQUOS R7 GhostLock temporary root Device-specific Linux 5.10 port of GhostLock CVE-2026-43499 for the Sharp AQUOS R7. The validated target is the AQUOS R7 Mineva, SGA202SH/A202SH running Android 14 build 03.00.11, kernel 5.10.237-android12-9-00013-gd09ef2e980e0-ab13968955 SM8450. The previous...

cve-2026-43499-m3q-azf1

GhostLock SELinux park — SM-S948U1 / AZF1 m3q 삼성 Galaxy S26 UltraSM-S948U1, 코드명 m3q의 펌웨어 S948U1UES3AZF1GKI 6.12.30-android16-5에서 동작하는 SELinux 전용 park 에 대한 연구 스냅샷입니다. 이 패키지는 완전한 루트가 아닙니다. SELinux를 Permissive로 전환하고 후속 작업에 필요한 만큼 reclaim을 유지합니다. 호스트uid=0은 여기서 달성되지 않습니다. GhostLock / CVE-2026-43499 작업...

IonStack-S22-cve-2026-43499

IonStack-S22-cve-2026-43499 원본 저장소와 병합됨: 여기에서 찾기 https://github.com/CamsShaft/IonStack-S22 내 SM-S901W S22 5.10.168-android12-9-27760517-abS901WVLS4DWL3에서 selinux permissive 상태의 커널 도메인 전체 루트. 참고 사항: 이번에는 아주 자세히 설명하지 않겠습니다. 이미 비슷한 저장소가 5,000개도 넘게 있고, 배운 바에 따르면 이 동일한 익스플로잇의 변형들은 거의 각자 대상 기기에 맞춰져 있어서...

s26-m1q-ghostlock-selinux

S26 SM-S942U1 / m1q GhostLock CVE-2026-43499 — uid=0 root + KernelSU 激活达成 针对 Samsung Galaxy S26（SM-S942U1，codename m1q，SoC SM8850 骁龙 8 Elite Gen2， 内核 6.12.30-android16-5-android16-5-pd30ff70，Android 16）的 CVE-2026-43499（GhostLock）提权研究。 ✅ 最终结果：uid=0 root + KernelSU 激活达成 exploit 后通过 root helper 验证 $...

aquos-r6-ghostlock

AQUOS R6 GhostLock 임시 루트 Sharp AQUOS R6를 위한 GhostLockCVE-2026-43499의 기기별 Linux 5.4 포팅입니다. 검증된 대상은 Android 11 빌드 S0029 / 01.00.06, 커널 5.4.61-qgki를 실행하는 SoftBank A101SHJudau입니다. ghostlock54 타깃은 실제 UID/GID 0을 획득하고, SELinux를 permissive로 변경하며, 기존 ADB 전송을 통해 직접 대화형 루트 셸을 엽니다. TCP로 수신 대기하지 않으며 전체 Linux...

mxc

Microsoft eXecution Container MXC MXC는 Windows, Linux, macOS에서 신뢰할 수 없는 코드모델 출력, 플러그인, 도구를 실행하기 위한 샌드박스 코드 실행 시스템 입니다. OS 네이티브 프로세스 샌드박스부터 완전한 VM에 이르기까지 다양한 격리 백엔드를 통합된 JSON 구성 스키마와 TypeScript SDK 뒤에 제공합니다. !WARNING 이 저장소에는 Microsoft Execution Containers에 대한 조기 통합과 개발자 피드백을 가능하게 하기 위해 게시된 코드의 초기...

CVE-2026-92359: Permissive Cross-domain Policy with Untrusted Domains

A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. The affected element is the function createstrandsapp of the file integrations/aws-strands/python/src/aguistrands/utils.py of the component CORSMiddleware. The manipulation results in permissive cross-domain policy with untrusted...

EUVD-2026-77804

garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/client.py Client.dump creates the OAuth token directory and garmintokens.json without explicit owner-only modes, so a permissive umask such as 022 can leave t...

Astra Linux – Vulnerability in Redis

Redis is an in-memory database that persists data on disk. Upon startup, Redis begins listening on Unix sockets before adjusting its permissions according to the user-provided configuration. If a permissive umask value is used, this can create a race condition that allows another process to...

Astra Linux – Vulnerability in Rails

The Actionpack Ruby gem versions prior to 6.1.3.2, 6.0.3.7, 5.2.4.6, and 5.2.6 have a possible denial-of-service vulnerability in the Token Authentication logic of the Action Controller, due to overly permissive regular expressions. Affected code uses authenticateorrequestwithhttptoken or...

CVE-2026-87049

A flaw was found in operator-foundry. Untrusted external actors can exploit over-permissive GitHub access tokens and Google Cloud Platform GCP Workload Identity Federation credentials granted to a third-party reusable workflow. By invoking this workflow on untrusted-triggerable events without...

CVE-2026-82726

Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...

CVE-2026-82726 AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...

CVE-2026-82726 AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...

EUVD-2026-68335

Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...

CVE-2026-82726 AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...

EEF-CVE-2026-82726 AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

Summary Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/...

CVE-2026-82726

CVE-2026-82726 is a permissive regular expression vulnerability in ash-project ash_phoenix (versions 2.1.26 through before 2.3.25). The function AshPhoenix.Helpers.get_subdomain/2 interpolated the root host raw into a regex, turning each dot into a wildcard and allowing metacharacters as pattern ...