CVE-2024-30804

ASUS Driver LPE PoC Злоупотребление физической памятью Это PoC для Local Privilege Escalation LPE , эксплуатирующий драйвер AsInsHelp64.sys. Он злоупотребляет легитимным подписанным драйвером ASUS для отображения физической памяти и перезаписи токенов ядра, что в итоге позволяет получить привилег...

SOC-Investigation-CVE-2024-49138

🛡️ Отчёт об исследовании SOC: Эксплуатация CVE-2024-49138 📌 Краткое резюме Название оповещения: SOC335 — Обнаружена эксплуатация CVE-2024-49138 Уровень критичности: Высокий Целевой хост: Victor 172.16.17.207 Операционная система: Windows 10 Основной пользователь: letsdefend Вердикт: Истинно...

EUVD-2026-91850

OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction...

EUVD-2026-91824

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead t...

CVE-2026-104474

OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction...

sudo-cve-2019-14287

sudo 철학 Sudo는 시스템 관리자가 사용자에게 제한된 루트 권한을 부여하고 루트 활동을 기록할 수 있도록 설계된 프로그램입니다. 기본 철학은 최소한의 권한만 부여하면서도 사용자가 작업을 수행할 수 있도록 하는 것입니다. sudo를 찾을 수 있는 곳 sudo를 빌드하기 전에 반드시 최신 버전인지 확인하십시오. 최신 sudo는 항상 익명 ftp를 통해 ftp.sudo.ws의 /pub/sudo/ 디렉토리나 sudo 웹사이트 https://www.sudo.ws/ 에서 얻을 수 있습니다. 배포판은 sudo-M.m.tar.gz이며,...

RockyLinux 9 : libvirt (RLSA-2026:74424)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:74424 advisory. libvirt: swtpm privilege escalation via symlink following CVE-2026-63622 libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffe...

PT-2026-104521

Name of the Vulnerable Software and Affected Versions WP Ultimate CSV Importer versions prior to 9.2 Description Insufficient validation of file types within uploaded archives and a lack of content sanitization before storage in a publicly accessible location allow high-privilege users to execute...

CVE-2026-97644: Improper Privilege Management

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the createcontact function in the v3 REST endpoint POST /gh/v3/contacts ...

PT-2026-104586

Name of the Vulnerable Software and Affected Versions Ultimate Member versions prior to 2.13.2 Description An authorization bypass exists due to a user-controlled key, which allows for privilege escalation. Recommendations Update to version 2.13.2 or later...

CVE-2026-104474: Time-of-check Time-of-use (TOCTOU) Race Condition

OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction...

PT-2026-104494

Name of the Vulnerable Software and Affected Versions Groundhogg — CRM, Newsletters, and Marketing Automation versions prior to 5.0 Description Privilege escalation is possible through contact identity rebinding. The create contact function in the POST /gh/v3/contacts endpoint is only protected b...

Linux Distros Unpatched Vulnerability : CVE-2026-104988

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Dogtag PKI pki-core. The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth...

CVE-2026-96451: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1...

CVE-2026-68138

CVE-2026-68138: Linux qdisc rate-table 경합을 이용한 로컬 루트 권한 상승 이 저장소에는 CVE-2026-68138 에 대한 개념 증명PoC 로컬 권한 상승 익스플로잇이 포함되어 있습니다. 이 취약점은 Linux 트래픽 제어 rate-table 코드의 경합race입니다. 테스트한 QEMU 환경에서 이 PoC는 외부 UID 1000을 가진 일반 프로세스에서 초기 사용자 네임스페이스의 UID 0 셸로 권한을 상승시킵니다. 경고 이 코드는 의도적으로 커널 힙 상태를 손상시킵니다. 소유한 격리된 일회용...

CVE-2026-66804-CrossDevice-LPE

CVE-2026-66804: Уязвимость повышения привилегий в службе Cross Device Microsoft Windows Доказательство концепции для LPE в CrossDevice/FrameServer, о котором я сообщил в MSRC и которому присвоен CVE-2026-66804. Уязвимость затрагивает Windows 10 и Windows 11. Уязвимость Windows регистрирует этот...

SharpStartWebclient

SharpStartWebclient Запустите из непривилегированного сеанса, чтобы запустить службу WebClient и включить это лакомое повышение привилегий. C-порт Beacon Object File из https://github.com/outflanknl/C2-Tool-Collection/blob/main/BOF/StartWebClient/SOURCE/StartWebClient.c...

amd-ryzen-master-driver-v17-exploit

Cobalt Strike Beacon Object File для эксплуатации ядра с помощью драйвера AMD Ryzen Master версия 17. Разработано Tijme. Благодарность Alex за обучение! Стало возможным благодаря Northwave Security Описание Это Cobalt Strike CS Beacon Object File BOF и исполняемый файл, которые эксплуатируют...

SeManageVolumeExploit

SeManageVolumeExploit Этот эксплойт предоставляет полные права на диск C:\ для всех пользователей на машине. Включает привилегию в токене Создаёт дескриптор к \.\C: с SYNCHRONIZE | FILETRAVERSE Отправляет FSCTLSDGLOBALCHANGE для замены S-1-5-32-544 на S-1-5-32-545 Перезапись «Printconfig.dll» для...

RToolZ

RToolZ Скрытный дампер Lsass — может использовать драйвер ProcExp152.sys для дампа PPL Lsass. Что в нём особенного? Никаких вызовов MiniDump или методов из dbghelp.lib: весь процесс дампа выполняется ВРУЧНУЮ самим дампером, при этом размер дампа сводится к минимуму за счёт удаления ненужных DLL...