CVE-2018-19788

CVE-2018-19788 CVE-2018-19788 の簡単なエクスプロイト これを使用するには、Policy Kit で UID が INTMAX より大きいユーザーを作成するか、その UID を持つ低権限ユーザーが既に存在している必要があります。 UID は以下のようにユーザー作成時に指定でき、スクリプト実行前に使用します： $ useradd -u 4000000001 PrivEsc $ passwd PrivEsc $ su PrivEsc $ chmod +x /tmp/CVE-2018-19788PrivEsc.sh $...

rootkit-signal-hunter

Rootkit Signal Hunter シグナルを使用してプロセス権限を昇格させる Linux ルートキットを検出します。 一部のルートキットは、特定のシグナルを待ち受けて権限を昇格するシグナルハンドラをインストールします。 このツールは、シグナルを送信して UID が root に切り替わるのを観測することで、これらのルートキットを特定できます。 必要に応じて root シェルを起動します。 検証済み: Singularity 5b6c4b6 2025-10-19 Ubuntu 24.04 kernel 6.8.0-31-generic x64 で Diamorphine...

ghostlock-pfem10

GhostLock — OPPO Find X5 Pro PFEM10 English · 中文 ColorOS 16 上の OPPO Find X5 Pro 向け GhostLock CVE-2026-43499 ポート。uid=0 の子プロセスとロード済みの kernelsu.ko に到達する。root プロセスは傍受される。 脆弱性 CVE-2026-43499 — futex PI の use-after-free。removewaiter は、current が requeuer である場合に current-piblockedon をクリアする。これは...

ubuntu-cve-2019-14287-patch-manager

Ubuntu CVE-2019-14287 パッチマネージャー Ubuntu CVE-2019-14287 パッチマネージャーは、sudo 権限昇格の脆弱性である CVE-2019-14287 に対する保護状態の確認、緩和、検証を行う GUI ベースのラボ用ツールです。 このプロジェクトは、Ubuntu 19.04 amd64 ラボ環境向けに開発されました。 プロジェクトの目的 CVE-2019-14287 は、旧バージョンの sudo に影響します。この脆弱性により、root を除外した sudoers ルールを持つユーザーが、-1 や 4294967295 のような細工された数値ユー...

docker_lightman_exploit

Docker Lightman Exploit Docker CVE-2022-37708。 このエクスプロイトは、Docker を実行するホストと Docker 内で実行されるクライアントとの間で Docker が共有するファイルに対して UNIX ファイルシステムが UID と GID を保持する仕組みと、プロセス ID の所有権が機能する性質に依存しています。 問題の要約 Docker は、クライアント内の共有からの ID を「ホストシステム」上のプライベート（かつ保護された）ディレクトリ（/var/lib/docker/volumes など）に直接マッピングします。...

GHSA-FP7W-M676-W7GC social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend

Impact The Vend OAuth2 backend used only the numeric Vend userid as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop coul...

EUVD-2026-86310

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend userid as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Ven...

CVE-2026-57176 social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend userid as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Ven...

CVE-2026-75907

The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufacturer serial number sent in the clear on every read and is not intended to be secret or to authenticate the holder. Validating on...

CVE-2026-75907 CVE-2026-75907

The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufacturer serial number sent in the clear on every read and is not intended to be secret or to authenticate the holder. Validating on...

CVE-2026-75907 CVE-2026-75907

The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufacturer serial number sent in the clear on every read and is not intended to be secret or to authenticate the holder. Validating on...

EUVD-2026-86156

The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufacturer serial number sent in the clear on every read and is not intended to be secret or to authenticate the holder. Validating on...

CVE-2026-75907

The door access control system on Norwegian Cruise Line assets is vulnerable to improper authentication because it grants entry based solely on the static 7-byte UID of an NTAG212 NFC chip . Since the UID is a manufacturer serial number sent in the clear and lacks challenge-response capabilities ...

Norwegian Cruise Line door access controller contains an improper authentication vulnerability

Overview Door access controllers used on Norwegian Cruise Line NCL ships contain an improper authentication vulnerability that permits a replayed unique identifer UID from a radio-frequency identification RFID device to grant unauthorized entry to areas secured by these controllers. Description...

CVE-2026-75907: Improper Authentication

The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufacturer serial number sent in the clear on every read and is not intended to be secret or to authenticate the holder. Validating on...

EUVD-2026-66388

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...

CVE-2026-96599

Isotope eCommerce through 2.9.10 derives order identifiers from uniqid instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers. Guest orders lack ownership verification, enabling attackers to access order details including billing address, customer...

CVE-2026-96599

Versions of Isotope eCommerce through 2.9.10 are vulnerable to an identifier prediction flaw. The application uses the uniqid() function rather than a cryptographically secure source to generate order identifiers. Because guest orders lack proper ownership verification, an unauthenticated attacke...

CVE-2026-96599 Isotope eCommerce through 2.9.10 Weak Order Identifier Generation

Isotope eCommerce through 2.9.10 derives order identifiers from uniqid instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers. Guest orders lack ownership verification, enabling attackers to access order details including billing address, customer...

EUVD-2026-85340

Isotope eCommerce through 2.9.10 derives order identifiers from uniqid instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers. Guest orders lack ownership verification, enabling attackers to access order details including billing address, customer...