Lucene search
+L

578 matches found

Kitploit
Kitploit
added 2026/09/15 9:36 a.m.6 views

subpath-exploit

サンプルKubernetesエスケープ(CVE-2017-1002101経由) 説明 本問題について耳にし、このガイドを参考にした後、もう少し詳しく調べてみたいと思いました。このリポジトリには、攻撃メカニズムを可能な限り単純な方法で示すいくつかのPodデプロイメントと補助シェルスクリプトが含まれており、Kubernetes管理者や運用者が深刻さと潜在的なリスクを完全に理解できるようにしています。認証済みユーザーであるか、Podのspec/template作成時に制御できる必要があるため、このエスケープが匿名で行われる可能性は低く、このような他の攻撃と組み合わせなければ実現しません。...

9.6CVSS7.8AI score0.13267EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/15 2:03 a.m.13 views

CVE-2026-14361

CVE-2026-14361 Consul Template の writeToFile ヘルパーは、オペレーターが指定した宛先を直接開き、リンクされたパスコンポーネントをたどるため、レンダリングされた出力が意図したディレクトリの外に逃れ、既存のファイルを上書きする可能性がありました。 はじめに この問題は、HashiCorp Consul Template をレビューしているときに、直接的なファイルシステムのセキュリティ問題を念頭に置いて見つけました。 writeToFile...

4.7CVSS5.9AI score0.00133EPSS
SaveExploits1
RedHat Linux
RedHat Linux
added 2026/09/14 7:43 p.m.7 views

rsync: rsync: Arbitrary File Read via Symlink Following

A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...

8.4CVSS0.00238EPSS
SaveExploits0References7
RedHat Linux
RedHat Linux
added 2026/09/14 7:43 p.m.6 views

rsync: rsync: Local Privilege Escalation via Symlink Following

A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges such as setuid or a privileged daemon, this enables arbitrary file overwrites and local privilege escalation...

8.5CVSS0.00229EPSS
SaveExploits0References7
RedHat Linux
RedHat Linux
added 2026/09/14 7:33 p.m.5 views

rsync: rsync: Arbitrary File Read via Symlink Following

A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...

8.4CVSS0.00238EPSS
SaveExploits0References7
RedHat Linux
RedHat Linux
added 2026/09/14 7:33 p.m.4 views

rsync: rsync: Local Privilege Escalation via Symlink Following

A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges such as setuid or a privileged daemon, this enables arbitrary file overwrites and local privilege escalation...

8.5CVSS0.00229EPSS
SaveExploits0References7
OSV
OSV
added 2026/09/14 4:34 p.m.10 views

OESA-2026-3832 libvirt security update

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes. The main package includes the libvirtd server exporting the virtualization support. Security Fixes: A flaw was found in libvirt. An unprivileged local user could exploit an integer...

7.8CVSS0.00163EPSS
SaveExploits0References5
SUSE Linux
SUSE Linux
added 2026/09/14 7:59 a.m.6 views

Security update for libvirt

This update for libvirt fixes the following issues: CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow bsc1275863. CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection bsc1274576. CVE-2026-63622...

8.5CVSS0.00163EPSS
SaveExploits0References20
Kitploit
Kitploit
added 2026/09/14 1:59 a.m.6 views

cve-2026-11837-ansible-posix-authorized-key

CVE-2026-11837: ansible.posix authorizedkey のローカル権限昇格 ansible.posix.authorizedkey Ansible モジュールにおける、ユーザーの /.ssh ディレクトリと authorizedkeys ファイルに対するシンボリックリンク追従 chown(およびシンボリックリンク追従によるファイル作成)を介したローカル権限昇格。 これは、私が報告し、Red Hat Product Security(CNA)によって CVE-2026-11837 が割り当てられた脆弱性の writeup...

7.3CVSS7.4AI score0.00161EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/13 8:36 p.m.12 views

CVE-2025-27591-Meta-below-LPE

CVE-2025-27591 — Meta below シンボリックリンク ローカル権限昇格 概要 項目| 詳細 ---|--- CVE| CVE-2025-27591 ソフトウェア| Meta below(システムリソースモニター) 影響を受けるバージョン| 0.9.0 脆弱性| シンボリックリンクの追跡 → root として任意のファイルを上書き 認証| below への sudo アクセス権を持つローカルユーザー 影響| root へのローカル権限昇格 背景| HackTheBox CTF 中に発見 説明 below システムリソース監視ツール(Meta Platforms, In...

6.8CVSS7.5AI score0.00364EPSS
SaveExploits23References1
Kitploit
Kitploit
added 2026/09/13 2:25 p.m.9 views

CVE-2024-50404

CVE-2024-50404 https://www.qnap.com/en/security-advisory/qsa-24-48 https://www.cve.org/CVERecord?id=2024-50404 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N 6.8 "Qsync Central にリンク追従の脆弱性が報告されています。この脆弱性が悪用されると、ユーザーアクセスを取得したリモートの攻撃者がファイルシステムを意図しない場所にたどることができる可能性があります。" 発見日: 22 Apr...

8.8CVSS5.9AI score0.01434EPSS
SaveExploits2
NVD
NVD
added 2026/09/11 11:16 a.m.8 views

CVE-2026-77159

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

5.5CVSS0.00162EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/09/11 11:15 a.m.8 views

EUVD-2026-76070

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...

9.3CVSS0.00315EPSS
SaveExploits0References2
Debian CVE
Debian CVE
added 2026/09/11 10:32 a.m.9 views

CVE-2026-77159

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

5.5CVSS0.00162EPSS
SaveExploits0
Cvelist
Cvelist
added 2026/09/11 10:32 a.m.36 views

CVE-2026-77159 Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

5.5CVSS0.00162EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/09/11 10:32 a.m.8 views

EUVD-2026-76034

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

5.5CVSS0.00162EPSS
SaveExploits0References3
CVE
CVE
added 2026/09/11 10:32 a.m.46 views

CVE-2026-77159

A symlink-following flaw in libvirt's qemuTPMEmulatorPrepareHost() function performs a path-based chown() on the swtpm log file without validating for symbolic links. A local attacker with access to the swtpm account can replace the log file with a symlink, causing the root-level libvirtd daemon ...

5.5CVSS0.00162EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2026/09/11 10:32 a.m.8 views

CVE-2026-77159

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

5.5CVSS0.00162EPSS
SaveExploits0References4
Tenable Nessus
Tenable Nessus
added 2026/09/11 12:00 a.m.7 views

Linux Distros Unpatched Vulnerability : CVE-2026-77159

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking...

5.5CVSS0.00162EPSS
SaveExploits0References4
Tenable Nessus
Tenable Nessus
added 2026/09/11 12:00 a.m.9 views

Linux Distros Unpatched Vulnerability : CVE-2026-88016

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with...

7.1CVSS0.00187EPSS
SaveExploits0References3
Rows per page
Query Builder