Lucene search
+L

581 matches found

Kitploit
Kitploit
added 2026/09/15 3:59 p.m.13 views

CVE-2026-14361

CVE-2026-14361 Consul Template 的 writeToFile 辅助函数直接打开操作者提供的目标路径,并跟随被链接的路径组件,从而使渲染输出能够逃逸预期目录并覆盖已存在的文件。 简介 我在审查 HashiCorp Consul Template 时发现了这个问题,当时脑海中有一个直接的文件系统安全问题: 如果writeToFile 收到的路径看似位于预期目录之内,它是否会验证文件系统实际将数据写入何处? 在本例中,答案是否定的。 writeToFile 模板辅助函数通过 os.Create 或 os.OpenFile 直接打开用户提供的最终路径。...

4.7CVSS5.8AI score0.00133EPSS
SaveExploits1
RedHat Linux
RedHat Linux
added 2026/09/15 10:08 a.m.3 views

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

7.8CVSS5.7AI score0.00232EPSS
SaveExploits0References8
RedHat Linux
RedHat Linux
added 2026/09/15 10:06 a.m.4 views

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

7.8CVSS5.7AI score0.00232EPSS
SaveExploits0References8
Kitploit
Kitploit
added 2026/09/15 9:36 a.m.8 views

subpath-exploit

通过 CVE-2017-1002101 实现 Kubernetes 逃逸示例 描述 在了解到这个问题并参考此指南后,我想进一步探索。该仓库包含几个 Pod 部署和辅助 Shell 脚本,以最简单的方式演示了攻击机制,使 Kubernetes 管理员和运维人员能够充分理解其严重性和潜在风险。您必须是已认证用户,或者能够在创建 Pod 时控制其 spec/template,因此这种逃逸不太可能以匿名方式发生,除非与其他攻击(如这个)结合使用。 快速解释 当 Kubelet 挂载卷/密钥/配置映射等时,它会错误地跟随卷内部的符号链接,访问到本应限制范围之外的位置。由于 Kubelet 以 ro...

9.6CVSS8AI score0.13267EPSS
SaveExploits2References1
RedHat Linux
RedHat Linux
added 2026/09/14 7:43 p.m.8 views

rsync: rsync: Local Privilege Escalation via Symlink Following

A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges such as setuid or a privileged daemon, this enables arbitrary file overwrites and local privilege escalation...

8.5CVSS6.7AI score0.00229EPSS
SaveExploits0References7
RedHat Linux
RedHat Linux
added 2026/09/14 7:43 p.m.8 views

rsync: rsync: Arbitrary File Read via Symlink Following

A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...

8.4CVSS6.5AI score0.00238EPSS
SaveExploits0References7
RedHat Linux
RedHat Linux
added 2026/09/14 7:33 p.m.5 views

rsync: rsync: Arbitrary File Read via Symlink Following

A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...

8.4CVSS6.5AI score0.00238EPSS
SaveExploits0References7
RedHat Linux
RedHat Linux
added 2026/09/14 7:33 p.m.5 views

rsync: rsync: Local Privilege Escalation via Symlink Following

A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges such as setuid or a privileged daemon, this enables arbitrary file overwrites and local privilege escalation...

8.5CVSS6.7AI score0.00229EPSS
SaveExploits0References7
OSV
OSV
added 2026/09/14 4:34 p.m.10 views

OESA-2026-3832 libvirt security update

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes. The main package includes the libvirtd server exporting the virtualization support. Security Fixes: A flaw was found in libvirt. An unprivileged local user could exploit an integer...

7.8CVSS6.2AI score0.00163EPSS
SaveExploits0References5
SUSE Linux
SUSE Linux
added 2026/09/14 7:59 a.m.7 views

Security update for libvirt

This update for libvirt fixes the following issues: CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow bsc1275863. CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection bsc1274576. CVE-2026-63622...

8.5CVSS6.2AI score0.00163EPSS
SaveExploits0References20
Kitploit
Kitploit
added 2026/09/14 1:59 a.m.6 views

cve-2026-11837-ansible-posix-authorized-key

CVE-2026-11837: ansible.posix authorizedkey 本地权限提升 通过跟随符号链接的 chown(以及跟随符号链接的文件创建)对用户的 /.ssh 目录和 authorizedkeys 文件,在 ansible.posix.authorizedkey Ansible 模块中实现本地权限提升。 这是一份关于我报告的漏洞的书面说明,该漏洞已被红帽产品安全团队(CNA)分配为 CVE-2026-11837 。此处作为技术记录发布,而非声称具有新颖性:该问题是 CVE-2024-9902 的 同源问题 ,早期修复未覆盖到该模块。 官方参考 红帽 CVE...

7.3CVSS7.2AI score0.00161EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
added 2026/09/14 12:00 a.m.4 views

CVE-2026-77159

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

5.5CVSS5.7AI score0.00162EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/13 8:36 p.m.13 views

CVE-2025-27591-Meta-below-LPE

CVE-2025-27591 — Meta below 符号链接本地权限提升 概述 字段| 详情 ---|--- CVE| CVE-2025-27591 软件| Meta below(系统资源监视器) 受影响版本| 前提条件: 当前用户必须拥有执行 /usr/bin/below 的 sudo 权限...

6.8CVSS7.5AI score0.00364EPSS
SaveExploits23References1
Kitploit
Kitploit
added 2026/09/13 2:25 p.m.10 views

CVE-2024-50404

CVE-2024-50404 https://www.qnap.com/en/security-advisory/qsa-24-48 https://www.cve.org/CVERecord?id=2024-50404 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N 6.8 “已报告一个链接跟随漏洞会影响 Qsync Central。若被利用,该漏洞可能允许已获得用户访问权限的远程攻击者遍历文件系统到非预期位置。” 发现日期: 2024年4月22日 修复日期: 2024年12月7日 受影响版本: Qsync...

8.8CVSS6AI score0.01434EPSS
SaveExploits2
NVD
NVD
added 2026/09/11 11:16 a.m.8 views

CVE-2026-77159

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

5.5CVSS0.00162EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/09/11 11:15 a.m.8 views

EUVD-2026-76070

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...

9.3CVSS5.6AI score0.00315EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/11 10:32 a.m.37 views

CVE-2026-77159 Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

5.5CVSS0.00162EPSS
SaveExploits0References3
Debian CVE
Debian CVE
added 2026/09/11 10:32 a.m.9 views

CVE-2026-77159

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

5.5CVSS5.8AI score0.00162EPSS
SaveExploits0
EUVD
EUVD
added 2026/09/11 10:32 a.m.8 views

EUVD-2026-76034

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

5.5CVSS5.8AI score0.00162EPSS
SaveExploits0References3
CVE
CVE
added 2026/09/11 10:32 a.m.46 views

CVE-2026-77159

A symlink-following flaw in libvirt's qemuTPMEmulatorPrepareHost() function performs a path-based chown() on the swtpm log file without validating for symbolic links. A local attacker with access to the swtpm account can replace the log file with a symlink, causing the root-level libvirtd daemon ...

5.5CVSS5.8AI score0.00162EPSS
SaveExploits0References3
Rows per page
Query Builder