CVE-2024-32019-ndsudo-local-privilege-escalation-NetData

CVE-2024-32019 概念验证（Python） 针对 Netdata （CVE-2024-32019）本地权限提升（LPE）漏洞的 Python 实现。 该脚本利用了 ndsudo 组件中 PATH 环境变量未正确清理的漏洞。本地攻击者可以通过劫持允许的二进制文件（如 nvme-list、ip、gem 等，您可以根据需要在代码开头修改它们）以 root 身份执行任意命令。 ⚠️ 免责声明 仅供教育目的使用。 此代码旨在供安全研究人员、CTF 参赛者和系统管理员测试自己的系统。作者对此代码的任何滥用概不负责。请勿将其用于未经许可测试的系统。 🚀 特性 纯 Python：...

CVE-2025-65753

CVE-2025-65753 CVE-2025-65753 的概念验证：在 Gryphon Guardian 接入点（固件版本 01.06.0006.22）上，由于 TLS 证书验证不当而导致的远程代码执行。 描述 Gryphon Guardian WiFi 接入点（固件版本 01.06.0006.22）未能正确验证通过应用提示后下载的互联网 speedtest 客户端的 TLS 证书。此缺陷使攻击者能够拦截并操纵通信，向该客户端注入恶意代码，随后该代码会以 root 身份在接入点上执行。 PoC 利用此漏洞有两种方式： 通过 MitM 攻击，直接拦截接入点与服务器之间的通信 通过伪造...

CVE-2025-32462-

CVE-2025-32462 – Sudo主机名绕过权限提升 目录 1. 概述 2. 漏洞详情 3. 影响 4. 实验环境 5. 验证受影响版本 6. 用户与sudoers配置 7. 利用演练 8. 概念证明总结 9. 为什么Ubuntu不受影响 10. 缓解措施 11. MITRE ATT&CK映射 12. 参考 13. 免责声明 概述 CVE-2025-32462 是一个 sudo 中的本地权限提升漏洞 ，允许低权限用户通过滥用主机名受限的sudo规则 ，以 root 身份执行命令。问题在于 sudo 在授权检查中历史上对 -h（主机）选项的处理方式。...

CVE-2026-73768

CVE-2026-73768 is a local privilege escalation in the command line interface (CLI) of HPE ArubaOS-CX (AOS-CX) . The root cause is improper processing of malformed input , which can allow a low-privilege local user to execute arbitrary commands with root privileges . The CVSS 3.1 base score is 7.3...

CVE-2024-30167

Atlona OME 认证命令注入的PoC 免责声明 ：此概念验证仅用于教育和研究目的。请勿在您不拥有或未经明确许可的系统上使用此代码。我对任何滥用行为概不负责。 在 Atlona AT-OME-RX21 音视频切换器的时间配置接口中存在一个经过认证的命令注入漏洞。具有有效凭据的用户可以注入作为 root 执行的操作系统命令，从而导致系统完全受损。 产品信息 Atlona AT-OME-RX21 是一款专为专业视频会议和协作环境设计的音视频接收器和缩放器。它主要用于会议室、教室和小型协作空间。它有助于将笔记本电脑/会议系统等设备连接到显示器。 此PoC适用于所有固件版本 2. 对目标...

CVE-2026-58567

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

CVE-2026-58567

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

EUVD-2026-69302

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

EUVD-2026-69299

Dell PowerStore contains a Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

CVE-2026-58571

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

CVE-2026-58571

Dell PowerStore is affected by an OS Command Injection vulnerability that allows an authenticated user with limited privileges to execute arbitrary commands with root privileges . The CVSS 3.1 score is 8.8 (HIGH) , with a local attack vector, low complexity, low privileges required, changed scope...

CVE-2026-59681

A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the configured host. Auth::AuthConf in src/lib/auth/authconf.rb assembles the Samba net ads join, net ads lookup -S and net ads...

CVE-2026-25706

Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Active Directory directory tree - a rogue domain controller, or a directory user delegated the right to create objects - to execute arbitrary commands as root ...

CVE-2026-25706 yast2-samba-client: OS command injection via attacker-controlled Organizational Unit (Active Directory-supplied)

Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Active Directory directory tree - a rogue domain controller, or a directory user delegated the right to create objects - to execute arbitrary commands as root ...

CVE-2026-25706

CVE-2026-25706 is an OS command injection in yast2-samba-client (SUSE), triggered when an attacker-controlled Organizational Unit (OU) value from an Active Directory directory tree is passed unsanitized to an OS command during interactive domain join. A rogue domain controller or a directory user...

EUVD-2026-69002

Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Active Directory directory tree - a rogue domain controller, or a directory user delegated the right to create objects - to execute arbitrary commands as root ...

CVE-2026-59681

CVE-2026-59681 is an OS command injection in yast2-auth-client (SUSE/YaST). The vulnerable code in Auth::AuthConf (src/lib/auth/authconf.rb) interpolates unsanitized Active Directory configuration values—Organizational Unit , dnsHostName , AD user name, and AD domain name—directly into net ads jo...

CVE-2026-59681 yast2-auth-client: OS command injection via unsanitized Organizational Unit / dnsHostName in AD join

A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the configured host. Auth::AuthConf in src/lib/auth/authconf.rb assembles the Samba net ads join, net ads lookup -S and net ads...

EUVD-2026-69001

A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the configured host. Auth::AuthConf in src/lib/auth/authconf.rb assembles the Samba net ads join, net ads lookup -S and net ads...

CVE-2026-59680 yast2-users: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribute

An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, getpasswordterm in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString, which performs no numeric validation, and passed the resulting...