CVE-2024-50404

CVE-2024-50404 https://www.qnap.com/en/security-advisory/qsa-24-48 https://www.cve.org/CVERecord?id=2024-50404 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N 6.8 "링크 추적link following 취약점이 Qsync Central에 영향을 미치는 것으로 보고되었습니다. 악용될 경우, 이 취약점으로 인해 사용자 접근 권한을 획득한 원격 공격자가 파일 시스템을 탐색하여...

subpath-exploit

샘플 Kubernetes 탈출 - CVE-2017-1002101 이용 설명 이 문제에 대해 듣고 이 가이드를 따라가면서, 좀 더 탐구해보고 싶었습니다. 이 리포지토리는 몇 가지 파드 배포와 헬퍼 셸 스크립트를 포함하여, 쿠버네티스 관리자와 운영자가 심각성과 잠재적 위험을 완전히 이해할 수 있도록 공격 메커니즘을 가장 간단한 방식으로 보여줍니다. 인증된 사용자이거나 파드의 스펙/템플릿을 생성 시 제어할 수 있어야 하므로, 이 탈출은 다른 공격예: 이것과 결합하지 않으면 익명으로 이루어지지 않을 가능성이 높습니다. 빠른 설명...

cve-2026-11837-ansible-posix-authorized-key

CVE-2026-11837: escalatione dei privilegi locali in ansible.posix.authorizedkey Escalatione locale dei privilegi nel modulo Ansible ansible.posix.authorizedkey tramite chown che segue i collegamenti simbolici e creazione di file che segue i collegamenti sulla directory /.ssh e sul file...

CVE-2025-27591-Meta-below-LPE

CVE-2025-27591 — Meta below: escalation locale dei privilegi tramite symlink Panoramica Campo| Dettagli ---|--- CVE| CVE-2025-27591 Software| Meta below monitor delle risorse di sistema Versioni interessate| 0.9.0 Vulnerabilità| Follow di symlink → sovrascrittura arbitraria di file come root...

CVE-2026-55569 aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...

CVE-2026-55569 aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...

CVE-2026-55569

aqua (aquaproj/aqua), a declarative command-line version manager written in Go, contains a symlink traversal flaw in pkg/unarchive/archives.go (HandleFile). The handler calls os.Symlink with an unvalidated LinkTarget and does not jail the target to the extraction destination. A subsequent regular...

CVE-2026-55108

KubeVela 's Terraform remote configuration loader in pkg/controller/utils/capability.go (function GetTerraformConfigurationFromRemote) is vulnerable to denial of service. When a user with low privileges (ability to create or update ComponentDefinition objects) registers a Terraform remote schemat...

CVE-2026-82248

gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal symlink during non-exclusive incremental materialization destinationisinitiallyempty: false when core.symlinks is true. If a symlink entr...

CVE-2026-82252

gitoxide before 0.52.1 is vulnerable to a repository boundary violation via symlinked .gitmodules files. When reading the worktree .gitmodules file, gitoxide follows symlinks, allowing an attacker to create a malicious repository where .gitmodules points outside the repository tree. This causes g...

EUVD-2026-67704

gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to pars...

EUVD-2026-67700

gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal symlink during non-exclusive incremental materialization destinationisinitiallyempty: false when core.symlinks is true. If a symlink entr...

CVE-2026-82248

gix-worktree-state before 0.33.0 (part of gitoxide ) is vulnerable to path traversal via symlink following on Windows. During non-exclusive (incremental) materialization with core.symlinks=true, if a symlink entry is first checked out at a path pointing outside the worktree, a subsequent checkout...

CVE-2026-82248 gitoxide before 0.33.0 Path Traversal via symlink following

gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal symlink during non-exclusive incremental materialization destinationisinitiallyempty: false when core.symlinks is true. If a symlink entr...

CVE-2026-80663

In the Linux kernel, the following vulnerability has been resolved: tools/power/x86/intel-speed-select: Harden daemon pidfile open Avoid symlink-based pidfile clobbering by opening the pidfile with ONOFOLLOW and validating it with fstat before locking/writing. The daemon currently uses a fixed...

PT-2026-83236

Name of the Vulnerable Software and Affected Versions KubeVela versions prior to 1.9.14 KubeVela versions 1.10.0-alpha.1 through 1.10.8 KubeVela versions 1.11.0-alpha.1 through 1.11.0-alpha.3 Description The Terraform remote configuration loader in KubeVela can be abused to cause a denial of...

CVE-2026-81690

openssl-encrypt pip package before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob, which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory, while ONOFOLLOW on the...

CVE-2026-56651

Dool in versions up to 1.3.8 is vulnerable to symlink following when the "--devel" flag is used, as the application opens a log file without the "ONOFOLLOW" flag. A local attacker can exploit this by creating a symlink at the expected log file path pointing to a sensitive file, causing dool to...

EUVD-2026-67046

openssl-encrypt pip package before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob, which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory, while ONOFOLLOW on the...

CVE-2026-56651 Arbitrary File Overwrite via Symlink Following in dool project

Dool in versions up to 1.3.8 is vulnerable to symlink following when the "--devel" flag is used, as the application opens a log file without the "ONOFOLLOW" flag. A local attacker can exploit this by creating a symlink at the expected log file path pointing to a sensitive file, causing dool to...