CVE-2024-0670-CheckMK-Agent-Local-Privilege-Escalation-Exploit

CVE-2024-0670 – CheckMK Agent 本地权限提升 PoC 本仓库包含 CVE-2024-0670 的一个简洁清晰的验证概念（PoC），该漏洞是 CheckMK Windows Agent 中的一个本地权限提升漏洞。 低权限用户可以通过滥用 MSI 修复过程中执行的可写临时文件路径来获取 SYSTEM 权限。 🔍 漏洞概述 厂商：Tribe29 CVE：CVE-2024-0670...

Astra Linux – Vulnerability in libpgjava

pgjdbc is an open-source PostgreSQL JDBC Driver. In affected versions, a prepared statement using either PreparedStatement.setTextint, InputStream or PreparedStatemet.setByteaint, InputStream will create a temporary file if the InputStream exceeds 2 kilobytes in size. This temporary file can be...

Astra Linux – Vulnerability in Golang-1.23

The “go bug” command writes to two files with predictable names in the system’s temporary directory for example, "/tmp". An attacker who has access to the temporary directory can create a symbolic link in one of these files, causing “go bug” to overwrite the target of the symbolic link...

Ubuntu 16.04 LTS : Gzip vulnerabilities (USN-8733-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8733-1 advisory. Micha Majchrowicz and Marcin Wyczechowski discovered that Gzip's gzexe utility created temporary files in an insecure manner when mktemp was unavailable....

USN-8733-1: Gzip vulnerabilities

Michał Majchrowicz and Marcin Wyczechowski discovered that Gzip's gzexe utility created temporary files in an insecure manner when mktemp was unavailable. A local attacker could possibly use this issue to overwrite arbitrary files. CVE-2026-41991 Elias Hasas, Michał Majchrowicz and Marcin...

USN-8733-1 gzip vulnerabilities

Michał Majchrowicz and Marcin Wyczechowski discovered that Gzip's gzexe utility created temporary files in an insecure manner when mktemp was unavailable. A local attacker could possibly use this issue to overwrite arbitrary files. CVE-2026-41991 Elias Hasas, Michał Majchrowicz and Marcin...

gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility

A flaw was found in the gzexe utility of GNU gzip. When the mktemp utility is not available, gzexe creates temporary files with predictable names based on the process ID. A local attacker can exploit this by pre-creating a symbolic link to an arbitrary file at the predicted temporary file path...

cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack

A flaw was found in the 'go bug' command within the Go programming language tools. This command writes to temporary files with predictable names. A local attacker with access to the system's temporary directory could exploit this by creating a symbolic link symlink with one of these predictable...

CVE-2026-66153

The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths...

Astra Linux – Vulnerability in Netty

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high-performance protocol servers and clients. Before version 4.1.59.Final, there was a vulnerability on Unix-like systems involving an insecure temporary file. When Netty’s...

Malicious code in dolyame-boxy-desktop-bnpl-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626b386d1f127bc0ed973dbac051023f0f021b0be476d1cd8678802ef98c5d42 On require of the package, index.js unconditionally loads bootstrap.js, which downloads a platform-specific binary from hostnames assembled via...

Malicious code in trapp-check-logs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fea7c6987689190a5c45008fc1bfbf14ae177c63630b38ced1190e0c5c3d7661 On require of the package, index.js loads bridge.js which selects a platform-specific payload path, fetches bytes over HTTPS from...

MAL-2026-12146 Malicious code in beaver-ui-hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86ba5710d957735b0f3fde73e6b6ba99347296b8dc992db5f1807924f3ffc139 The package's declared main index.js unconditionally loads ext.js, which on require fetches a platform-specific binary from obfuscated Cloudflare...

MAL-2026-12079 Malicious code in volna-boxy-di-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector caad3654d755de84a91ca9afc1d7d393a1e2868b54b0b03020780b7878df28f8 On require, index.js loads compat.js which selects a platform-specific payload path, reconstructs C2 hostnames at runtime from split string fragments...

cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack

A flaw was found in the 'go bug' command within the Go programming language tools. This command writes to temporary files with predictable names. A local attacker with access to the system's temporary directory could exploit this by creating a symbolic link symlink with one of these predictable...

PT-2026-66517

Name of the Vulnerable Software and Affected Versions Apache Kyuubi versions 1.7.0 through 1.11.1 Description Improper handling of REST batch multipart uploads allows a remote attacker to use path traversal sequences in the client-supplied filename. This can lead to the server writing controlled...

CVE-2026-55629

CVE-2026-55629 affects Whistle (HTTP/HTTP2/HTTPS/WebSocket proxy). Before 2.10.3, the code path in lib/service/service.js for GET /cgi-bin/temp/get uses req.query.filename and joins it to TEMP_FILES_PATH only if it matches the temp-file pattern; otherwise it passes the user-supplied filename to g...

CVE-2026-58661 n8n - Disk Space Exhaustion via Data-Table File Upload Endpoint

n8n before 2.28.0 and before 1.123.58 on the 1.x branch contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary directory, allowing an authenticated user to repeatedly...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Gzip vulnerabilities (USN-8512-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8512-1 advisory. It was discovered that Gzip's gzexe utility handled temporary files in an insecure manner. When the mktemp utility was not...

GHSA-2W8R-9XJ7-69J5 mktemp: empty TMPDIR creates temp files in CWD instead of /tmp

The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back to /tmp when TMPDIR is an empty string, the uutils implementation treats the empty string as a valid path. This causes temporary files to be created in the...