525 matches found
CopyEscape-CVE-2026-17106
CopyEscape: docker cp で Docker ホストを乗っ取る CVE-2026-17106 これはブログ記事 CopyEscape:docker cp で Docker ホストを乗っ取る — CVE-2026-17106 の PoC リポジトリです。 CopyEscape は、悪意のある実行中のコンテナが Docker のアーカイブ生成処理と競合し、不整合な tar ストリームを作成できるようにします。脆弱な Docker CLI は、展開中に仕込まれたシンボリックリンクをたどり、docker cp...
RegPwnBOF
RegPwn BOF Cobalt Strike BOF 포트로, Filip Dragovic @Wh04m1001 / MDSec ActiveBreach 의 RegPwn 익스플로잇을 기반으로 합니다. 이는 원래 C 익스플로잇을 대충 BOF로 재구현한 것입니다. 취약점 연구 및 익스플로잇에 대한 모든 공로는 Filip Dragovic과 MDSec에 있습니다. 블로그 포스트 : https://www.mdsec.co.uk/2026/03/rip-regpwn/ 원본 저장소 :...
AZL-104570 CVE-2026-97950 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: configfs: pin the symlink target's dirent instead of chasing -cidentry createlink reads the target's configfsdirent from item-cidentry-dfsdata, relying on the item reference taken by gettarget. That reference pins the item, not i...
EUVD-2026-86804
In the Linux kernel, the following vulnerability has been resolved: configfs: pin the symlink target's dirent instead of chasing -cidentry createlink reads the target's configfsdirent from item-cidentry-dfsdata, relying on the item reference taken by gettarget. That reference pins the item, not i...
CVE-2026-97950 configfs: pin the symlink target's dirent instead of chasing ->ci_dentry
In the Linux kernel, the following vulnerability has been resolved: configfs: pin the symlink target's dirent instead of chasing -cidentry createlink reads the target's configfsdirent from item-cidentry-dfsdata, relying on the item reference taken by gettarget. That reference pins the item, not i...
NimbusPWN-CVE-2022-29799-29800
NimbusPwn — networkd-dispatcher !NOTE 他のディストリビューション: dnf install gcc dbus-devel pkgconf（Fedora/RHEL）またはpacman -S gcc dbus pkgconf（Arch）。コンパイル行は同じです。 ⚙️ 使い方 脆弱なホスト上で非特権ユーザーとして実行します。 root@kitploit: ./nimbuspwn -c -s SHELL -c, --check non-breaking vuln check, no exploitation -s, --shell SHELL shell t...
CVE-2023-38571-a-macOS-TCC-bypass-in-Music-and-TV
エグゼクティブサマリー macOS のミュージックおよび TV アプリは、安全でないリネーム処理を実行しており、その結果としてユーザーの TCC.db に対する完全な制御を得る FDA フルディスクアクセス を引き起こします。 このバグは各アプリごとに別々のチケットで報告しています。該当する場合はマージしていただいて構いません。 根本的な問題は、これらのアプリが FDA を持っているにもかかわらず、ファイル操作をサニタイズしていないことです。 エクスプロイトの説明 ミュージックと TV はこの点においてほぼ同一であり、パスが異なるだけです。以降はミュージックを例として説明します。TV...
RegPwnBRc4BOF
RegPwn BOF（Brute Ratel C4 用） RegPwn エクスプロイトの Filip Dragovic （@Wh04m1001）/ MDSec ActiveBreach によるポート実装を、私が Brute Ratel C4 の BOF として再実装したものです。 これは、Flangvik による CS BOF 再実装（元の C エクスプロイトの再実装）を、より雑に BRc4 の BOF として再実装したものです。脆弱性の研究とエクスプロイトに関するすべての功績は、引き続き Filip Dragovic 氏と MDSec に帰属します。 Flangvik の CS BOF...
CVE-2026-5061
CVE-2026-5061 Consul Template は、テンプレート評価時にシンボリックリンクが指す先を検証していましたが、その後の依存関係の取得では元のパスを読み取っていました。それらの操作の間にリンクを張り替えることで、サンドボックス内のファイル参照がサンドボックス外のファイル開示に変わってしまいました。 はじめに 私は HashiCorp Consul Template をレビューしているときに、非常に具体的なセキュリティ上の疑問を抱いてこの問題を発見しました： テンプレート評価中にsandboxpath...
below-log-race-poc
below-log-race-poc CVE-2025-27591 エクスプロイト Below 権限昇格 説明 このリポジトリには、below ユーティリティの権限昇格の脆弱性である CVE-2025-27591 の概念実証エクスプロイトが含まれています。 この問題は、below が /var/log/below/ 配下のログファイルを適切に処理しないために発生し、攻撃者がログを /etc/passwd などの機密ファイルへのシンボリックリンクに置き換えることを可能にします。 これを悪用することで、非特権ユーザーが新しい root ユーザーエントリを注入し、権限を昇格させることができます...
Linux Distros Unpatched Vulnerability : CVE-2026-91203
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged fi...
OESA-2026-3949 rsync security update
Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files a...
DEBIAN-CVE-2026-91203
A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can...
CVE-2026-91203
A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can...
CVE-2026-91203
A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can...
CVE-2026-91205
A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link symlink before the ownership change...
UBUNTU-CVE-2026-91203
A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can...
CVE-2026-91203
CVE-2026-91203 is a symlink race condition in cockpit-files that allows a local attacker with low privileges to redirect privileged file operations (such as changing file ownership or permissions) to unintended files by manipulating directory entries. This can lead to unauthorized modification of...
CVE-2026-91203
A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can...
EUVD-2026-83296
A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can...