Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in exim4

Exim 4 before 4.94.2 allows Heap-based Buffer Overflows because it mishandles the "-F’.‘” syntax on the command line. This may allow privilege escalation from any user to root. This issue occurs due to the incorrect interpretation of negative sizes in the strncpy function...

Astra Linux – Vulnerability in Apache2

A privilege escalation bug in various modules of Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue...

Astra Linux – Vulnerability in Mariadb 10.3

Vulnerability in the MySQL Client product of Oracle MySQL component: Client: mysqldump. The supported versions affected are 8.0.0–8.0.41, 8.4.0–8.4.4, and 9.0.0–9.2.0. This vulnerability is difficult to exploit; it allows low-privilege attackers with network access via multiple protocols to...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: vxlan: It is required to have CAPNETADMIN in the device’s netns for the changelink function. A tunnel changelink operates on at most two netns: devnetdev and the sticky underlay netns vxlan-net. These two netns differ once the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: - net: ip6gre: Requires CAPNETADMIN in the device netns for changelink. - ip6grechangelink and ip6erspanchangelink operate on at most two netns: devnet and the tunnel link netns t-net. They differ when the device is created in...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: geneve: It is required that CAPNETADMIN is set in the device’s netns for the changelink function. A tunnel changelink operates on at most two netns: devnetdev and the sticky underlay netns geneve-net. These differences arise...

Astra Linux – Vulnerability in cifs-utils

It was discovered that cifs-utils’ mount.cifs function invoked a shell when requesting the Samba password, which could be exploited to inject arbitrary commands. An attacker who had special permissions, such as those through sudo rules, could use this vulnerability to escalate their privileges...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: exec: Fix for the issue involving the comparison between permission checks and setuid/gid usage When opening a file for execution using dofilpopen, permission checks are performed based on the file’s metadata at that moment. If t...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

A vulnerability was discovered in the Linux kernel before version 6.5.9. This vulnerability could be exploited by local users who have access to MMIO registers through the user space. Incorrect access checks in the VC handler, along with improper emulation of MMIO accesses using the SEV-ES...

Astra Linux – Vulnerability in Samba

Netlogon RPC Elevation of Privilege Vulnerability...

CVE-2025-2304

Camaleon CMS v2.9.1 — Массовое присвоение приводит к повышению привилегий — Эксплойт-инструмент — PoC Описание Этот проект представляет собой инструмент доказательства концепции эксплуатации на Python, который демонстрирует и анализирует уязвимость повышения привилегий, затрагивающую Camaleon CMS...

USN-8867-1: Ceph vulnerability

It was discovered that the Ceph Object Gateway RGW SigV4 handler did not reject requests carrying x-amz- headers that were absent from the signed header set. An attacker holding a presigned URL could possibly use this issue to attach arbitrary unsigned x-amz- headers that RGW would honor, allowin...

USN-8867-1 ceph vulnerability

It was discovered that the Ceph Object Gateway RGW SigV4 handler did not reject requests carrying x-amz- headers that were absent from the signed header set. An attacker holding a presigned URL could possibly use this issue to attach arbitrary unsigned x-amz- headers that RGW would honor, allowin...

CVE-2025-27591

CVE-2025-27591 Below v0.9.0 PoC 권한 상승 익스플로잇 면책 조항 이 익스플로잇은 교육 목적 전용 으로 제작되었습니다. 사용자가 보안 취약점을 이해하고 사이버 보안 지식을 향상시키도록 설계되었습니다. 저자는 불법 활동이나 시스템에 대한 무단 접근을 용인하지 않습니다. 이 정보는 책임감 있게, 테스트에 대한 명시적 허가가 있는 환경에서만 사용하십시오. 설명: Below 서비스는 v0.9.0 이전 버전에서 /var/log/below에 모든 사용자가 쓰기 가능한world-writable 디렉터리를 생성하여 권...

WordPress SMS Alert Order Notifications plugin <= 4.0.0 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Peter Tang in WordPress Plugin SMS Alert Order Notifications versions = 4.0.0...

-CVE-2021-4034

Отчет об эксплуатации CVE-2021-4034 PwnKit Официальное резюме оценки безопасности Контролируемые доказательства эксплуатации CVE-2021-4034 с документированным воздействием и рекомендациями по устранению. Метаданные отчета Поле| Значение ---|--- CVE ID| CVE-2021-4034 Название уязвимости| PwnKit...

cve-2026-0828

CVE-2026-0828 — PoC BYOVD для Safetica ProcessMonitorDriver.sys Драйвер ядра Safetica DLP ProcessMonitorDriver.sys предоставляет неаутентифицированный IOCTL, который позволяет любому пользовательскому вызывающему объекту завершать произвольные процессы через ZwTerminateProcess в контексте ядра,...

Security Bulletin: Kernel privilege escalation and disclosure Vulnerabilities in Linux in IBM Cloud Pak System[CVE-2026-46300, CVE-2026-46333, CVE-2026-43284]

Summary Multiple vulnerabilities in the Linux kernel affect the underlying operating system used by Platform system Manager PSM and OS Image for Red Hat Enterprise Linux Systems shipped with Cloud Pak System, . These issues include a local privilege escalation flaw in the networking subsystem...

kernel: gfs2: Fix slab-use-after-free in qd_put

A flaw was found in the Linux kernel's GFS2 file system. During filesystem shutdown, quota data objects were freed without being properly removed from the Least Recently Used LRU list. This oversight could lead to a use-after-free vulnerability, where the system attempts to access memory that has...