Document-Linux-Privilege-Escalation

Escalada de privilegios en Linux a través de snapd Objetivo del proyecto: Explotar la vulnerabilidad llamada "DirtySock" CVE-2019-7304 en la API REST del demonio snapd de Canonical un servicio predeterminado en Ubuntu Linux, para obtener acceso root. Guía de Ramil Mustafayev:...

suricata_exporter

Exportador Prometheus de Suricata Este es un Exportador Prometheus para Suricata que utiliza dump-counters a través del socket Unix para consultar métricas. Uso root@kitploit: $ ./suricataexporter -h Usage of ./suricataexporter: -suricata.socket-path string Path to the Suricata Command socket...

CVE-2026-19931

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

CVE-2024-31317

CVE-2024-31317 Prólogo Hace un par de días vi que la cuenta oficial de JD publicó un análisis de la vulnerabilidad CVE-2024-31317. Después de leerlo completo, me pareció bastante interesante, y dado que las soluciones principales actuales para unidades de cabeza head units de vehículos son sistem...

GHSA-92X3-5H48-MFHX vulnerabilities

Vulnerabilities for packages: terraform-fips, vault-fips, opentofu-fips, terraform, opentofu, terraform-ls, terraform-mcp-server, helmfile, vault...

uptux

uptux Vérifications spécialisées d'escalade de privilèges pour les systèmes Linux. Implémenté jusqu'à présent : Chemins systemd, services, minuteries et unités de socket accessibles en écriture Désassemble les fichiers d'unité systemd en recherchant : Références à des exécutables accessibles en...

CVE-2026-80906

In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transportheader when sending VLAN-tagged frame In packetparseheaders, when processing a VLAN-tagged frame, skbsetnetworkheader is called to advance networkheader past the VLAN tag to the inner protocol...

CVE-2026-80797

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: purge fragmented skbs during cleanup pn53xcommonclean purges respq before freeing the common PN533 state, but it leaves fragmentskb untouched. The fragmentation helpers queue transmit fragments there while sending lar...

GHSA-FPH4-WMHF-6FWF vulnerabilities

Vulnerabilities for packages: prism, vitess, opensearch-dashboards, nextcloud-server, tileserver-gl, yaml-language-server...

CVE-2026-80753

In the Linux kernel, the following vulnerability has been resolved: ovpn: run deferred work on a module-owned workqueue ovpn queues several work items whose callbacks execute module text. These works currently run on the global system workqueues, so module exit has no driver-owned drain point tha...

CVE-2026-80747

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized...

CVE-2026-80741

In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix out-of-bounds read on empty message length drmlogdrawkmsgrecord accesses slen - 1 to strip the trailing newline, but len is unsigned int. If len is 0, the subtraction wraps to UINTMAX, causing an out-of-bounds read...

CVE-2026-84381

HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/sync/socksproxy.py and src/httpcore2/httpcore2/async/socksproxy.py when the remote origin uses wss through a SOCKS5 proxy because the TLS upgrade condition only recognizes...

CVE-2021-40438

Exploit PoC para CVE-2021-40438 con configuración de Docker Navega al directorio que contiene la configuración de Apache y el Dockerfile compartidos en el repositorio. Construyendo la imagen: docker build -t cve-2021-40438:1.0 . Ejecutando la imagen Docker: docker run --rm -d -p 4444:80...

EUVD-2026-66587

In the Linux kernel, the following vulnerability has been resolved: afunix: Unlink sccentry in unixdeledge. Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1 Create two SCCs: X -. A B ^--' 2 Run the following concurrently: 2-1 send sk-B to sk-B from sk-X 2-...

CVE-2026-80580

In the Linux kernel, the following vulnerability has been resolved: fbdev: bound mode sysfs output to the sysfs buffer modestring uses snprintf which can return a value larger than the remaining buffer space. showmodes accumulates the return value into i without checking whether i has reached...

CVE-2026-80578

In the Linux kernel, the following vulnerability has been resolved: fbdev: core: Fix pointer desynchronization in fbioread In fbioread, if copytouser performs a partial copy e.g., due to a faulty user buffer, the loop adjusts the chunk size 'c' and updates the remaining 'count'. However, the...

CVE-2026-80562

In the Linux kernel, the following vulnerability has been resolved: gpio: ml-ioh: use rawspinlockt for the register lock iohirqtype is registered as the irqchip .irqsettype callback and takes chip-spinlock with spinlockirqsave. This callback is reached from setupirq - irqsettrigger -...

CVE-2026-80555

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Free all memory if cpinit fails The routine cpfree is called to unpin/free any memory once an I/O is completed successfully, or if cpprefetch fails. But if cpinit fails, and cp-initialized is not enabled, the same...

CVE-2026-80552

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Ensure index for read/write regions are within range The introduction of the capability chain rightly clamped the region indexes to the range of the capabilities itself, but neglected to do so for the existing...