8958 matches found
CVE-2022-25365
CVE-2022-25365 The privilege escalation vulnerability in Docker Desktop for Windows reference: https://www.cyberark.com/resources/threat-research-blog/breaking-docker-named-pipes-systematically-docker-desktop-privilege-escalation-part-1 File list poc.py Coded by followboy1999 createsymlink.exe...
CVE-2025-27591-PoC
CVE-2025-27591 PoC: Local Privilege Escalation in Below v0.9.0 Proof of Concept for CVE-2025-27591, a vulnerability that allows to local unprivileged users to escalate their privileges to root through symlink attacks. 🕵️♂️ Technical Details The vulnerability affects the Below service versions...
CVE-2024-31771
CVE-2024-31771 TotalAV Arbitrary File Write TotalAV version 6.0.x https://github.com/restdone/CVE-2024-31771/assets/42227817/ffe0c2ec-4ea6-4c29-852f-456b2e62f5b1 Timeline: 13th Feb, 2024 : Discovered 6.0.740 vulnerable and reported to TotalAV. 15th Feb, 2024: TotalAV confirmed and reproduced the...
CVE-2025-27591-Below
CVE-2025-27591-Below 📌 Description This is a proof-of-concept PoC exploit for CVE-2025-27591 , a local privilege escalation vulnerability in the below system monitor tool. The issue arises from unsafe handling of log files /var/log/below/errorroot.log when executed with elevated privileges. By...
Linux-Privilege-Escalation-CVE-2025-27591
CVE-2025-27591 - Privilege Escalation via Writable Symlink in below Summary This is a simple exploit for CVE-2025-27591 , a local privilege escalation vulnerability in the below Linux system monitoring tool. The vulnerability affects versions prior to v0.9.0 and stems from incorrect permission...
CVE-2025-8110
CVE-2025-8110 — Gogs RCE PoC Silentium / HackTheBox 면책 조항: 이 도구는 교육 목적과 승인된 침투 테스트 용도로만 제작되었습니다. 명시적인 테스트 허가를 받은 시스템에만 사용하십시오. 이것은 zAbuQasem/gogs-CVE-2025-8110의 수정 버전으로, HackTheBox의 Silentium 머신에서 작동하도록 조정되었습니다. 원본 PoC는 Silentium의 특정 Gogs 구성 및 인증 흐름을 처리하기 위한 수정이 필요했습니다. 취약점 CVE-2025-8110 는 자체 호스팅...
Safenet_SAC_CVE-2021-42056
Safenet Authentication Client Privilege Escalation CVE-2021-42056 Based on Thales' website 1, SafeNet Authentication Client – is a middleware client that manages Thales' extensive SafeNet portfolio of certificate-based authenticators, including eTokens, SafeNet IDPrime smart cards, USB and...
CVE-2025-27591-below-
CVE-2025-27591 – Privilege Escalation in Below 1 Introduction Below is a Linux tool for recording and displaying system data such as hardware utilization and cgroup metrics. In versions prior to v0.9.0 , Below’s systemd service runs with root privileges and creates world-writable log directories...
CVE-2007-4559
CVE-2007-4559 시연 이게 무엇인가요? 이 문서는 파이썬 3.11.4 이전 버전에서 tar 파일 추출 시 기본 처리 방식이 간단한 심볼릭 링크 공격에 취약한 방법을 시연합니다. 아래 지침은 악성 페이로드를 제작하는 방법을 설명합니다. untar.py 스크립트는 3.11.4에 추가된 기능이 어떻게 작동하는지와 그 이유를 보여줍니다. 특히 모든 파일에 대해 모든 쓰기 전에 os.path.realpath를 호출해야 하는 필요성을 강조합니다. 이 스크립트는 파이썬 = 3.11.4에 포함된 추출 필터 기능에서 사용되는 것과 정...
CVE-2025-63946-Tencent-PC-Manager-EoP
CVE-2025-63946 Tencent PC Manager EoP version: PCManager Version lower or equal 17.10.28554.205 Summary: I discovered a vulnerability in Tencent PC Manager where files and directories under C:\Windows\Temp are insecurely handled. An attacker can leverage symbolic link symlink attacks to coerce a...
CVE-2026-88924
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...
CVE-2025-10576
CVE-2025-10576 HP Sound Research SECOMNService Escalation of Privilege. Weak registry permissions allows any user to create a registry symlink and force the SECOMNService service to create an arbitrary registry key. How to: root@kitploit: 1. soundresearchpoc.exe prepare 2. Restart SECOMNService o...
CVE-2026-88924 Gvfs: gvfs-admin socket ownership race permits local root
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...
CVE-2025-27591
Exploit for CVE-2025-27591 For educational purposes only Built for HTB machine "Outbound" How does CVE-2025-27591 work? CVE-2025-27591 is a local privilege escalation vulnerability for the Service Below in versions prior to 0.9.0. The service creates a world-writable directory at /var/log/below...
CVE-2025-63945-Tencent-iOA-EoP
CVE-2025-63945 Tencent iOA EoP Version : before 210.9.28693.62001 Summary: I discovered a vulnerability in Tencent PC Manager where files and directories under C:\Windows\Temp are insecurely handled. An attacker can leverage symbolic link symlink attacks to coerce a SYSTEM-privileged process into...
Unity Linux 20.1070a Security Update: gzip (UTSA-2026-107043)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107043 advisory. GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the users PATH, gzexe...
PT-2026-89458
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...
gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility
A flaw was found in the gzexe utility of GNU gzip. When the mktemp utility is not available, gzexe creates temporary files with predictable names based on the process ID. A local attacker can exploit this by pre-creating a symbolic link to an arbitrary file at the predicted temporary file path...
privesc-CVE-2015-5602
Sudo =1.8.14 Local Privilege Escalation Sudo su "do" allows a system administrator to give certain users or groups of users the ability to run some or all commands as root while logging all commands and arguments. Vulnerable environment To setup a vulnerable environment for your test you will nee...