DriverJack

DriverJack はじめに DriverJack は、あまり知られていない NTFS テクニックを悪用して脆弱なドライバーを読み込むように設計されたツールです。これらの手法は、既存のサービスをハイジャックすることでシステム上でのドライバーサービスの登録をバイパスし、さらにドライバー読み込みイベントに表示されるイメージパスもスプーフィングします。脆弱なドライバーの存在をさらに偽装するため、この攻撃はエミュレートされたファイルシステムの読み取り専用バイパスも悪用し、読み込む前にマウントされた ISO 上のドライバーファイルのコンテンツを置き換えます。...

dirtyCow

DirtycowはCVE-2016-5195としても知られ、過去の非常に有名な脆弱性です。 まず、その脆弱性に適したLinuxバージョンを選択してください。次に、VBOXまたはVMWareにインストールまたは実行します。インストール後、以下の手順に従ってください。 1. rootアクセス権のないユーザーを作成します。 2. 作成したユーザーにログインします。 3. ディレクトリを作成します。 4. ‘.txt’ドキュメントにrootアクセス権を作成し、読み取り専用権限を付与します。 5. ‘.txt’ファイルが作成された場所で‘.c’ファイルをコンパイルして実行します。 6...

CVE-2026-61851: Incomplete List of Disallowed Inputs

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js attempts to enforce read-only database access with a blocklist...

pgadmin-ai-assistant-sql-injection-cve-2026-17351-lexer-differential-bypass

CVE-2026-17351 — pgAdmin 4 AI アシスタントのレキサー差分による読み取り専用バイパス CVE-2026-17351 の PoC。pgAdmin 4 の AI アシスタントに存在する重大な（CVSS 9.0）SQL インジェクションバイパスです。 脆弱性の概要 pgAdmin 4 バージョン 9.13 から 9.16 は、Python の sqlparse ライブラリを使用して、LLM が生成した SQL クエリが単一の読み取り専用ステートメントであることを検証します。PostgreSQL の standardconformingstrings =...

Linux Distros Unpatched Vulnerability : CVE-2026-93144

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Reject writes through untrusted BTF pointers checkptrtobtfaccess lets program-type btfstructaccess callbacks validate writes before the default BTF access...

CVE-2026-54648

CubeCart (an ecommerce platform) is vulnerable to unauthorized customer data deletion in versions prior to 6.7.5 . The GDPR tools in admin/sources/customers.gdpr.inc.php rely only on page-level CC_PERM_READ access and fail to enforce CC_PERM_DELETE for the purge, no_order_purge, and delete_guests...

AZL-102489 CVE-2026-93144 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject writes through untrusted BTF pointers checkptrtobtfaccess lets program-type btfstructaccess callbacks validate writes before the default BTF access path rejects non-read accesses. That bypasses the read-only policy fo...

DEBIAN-CVE-2026-90263

In the Linux kernel, the following vulnerability has been resolved: btrfs: check if root is readonly when setting posix acl For a filesystem which has btrfs read-only property set to true, all write operations including acl and xattr should be denied. However, acl can still be set even if btrfs r...

CVE-2026-90263

In the Linux kernel, the following vulnerability has been resolved: btrfs: check if root is readonly when setting posix acl For a filesystem which has btrfs read-only property set to true, all write operations including acl and xattr should be denied. However, acl can still be set even if btrfs r...

CVE-2026-93144 bpf: Reject writes through untrusted BTF pointers

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject writes through untrusted BTF pointers checkptrtobtfaccess lets program-type btfstructaccess callbacks validate writes before the default BTF access path rejects non-read accesses. That bypasses the read-only policy fo...

CVE-2026-90263: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: btrfs: check if root is readonly when setting posix acl For a filesystem which has btrfs read-only property set to true, all write operations including acl and xattr should be denied. However, acl can still be set even if btrfs r...

Astra Linux – Vulnerability in Samba

A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions, when the Samba VFS module “aclxattr” is configured with “aclxattr:ignore system acls = yes”. The SMB protocol allows opening files when the client requests read-only...

Astra Linux – Vulnerability in Linux

A issue was discovered in Linux: improper handling of VMIO|VMPFNMAP vmas in KVM can bypass RO checks and cause pages to be freed while still accessible by the VMM and guest. This allows users who have the ability to start and control a VM to read/write random pages of memory, potentially leading ...

CVE-2026-88891

OpenPanel fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private...

CVE-2026-88891 OpenPanel Read-Only Access Level Enforcement Bypass via Mutations

OpenPanel fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private...

PT-2026-89402

OpenPanel fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private...

CVE-2026-87911

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...

CVE-2026-87911 Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...

CVE-2026-87911

CVE-2026-87911 is a CRITICAL (CVSS 9.6) OS command injection vulnerability in the SQL validation component of Amazon awslabs postgres-mcp-server prior to version 1.1.7. The flaw lies in the read-only enforcement , which can be bypassed by injecting a crafted COPY ... TO PROGRAM statement into con...

CVE-2026-87911 Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...