DLL_Injection_On_VLC

DLL-инъекция и CVE-2010-3124 Обзор 🌱 Этот проект исследует тему DLL-инъекции Dynamic Link Library и конкретно фокусируется на CVE-2010-3124. CVE-2010-3124 относится к уязвимости недоверенного пути поиска, обнаруженной в VLC Media Player версии 1.1.3 и ранее. Вот ключевые моменты, которые помогут...

CVE-2024-32019-POC

⚠️ CVE-2024-32019 - PoC 📌 Versions concernées = v1.45.0, = v1.44.0-60, v1.45.0-169 🛠️ Preuve de concept CVE-2024-32019 — ndsudo escalade de privilèges locale via chemin de recherche non fiable. 🔧 Compiler l'exploit x8664-linux-gnu-gcc -o nvme exploit.c -static 📤 Déployer sur la machine cible 1...

CVE-2024-50986

CVE-2024-50986: Эксплойт перехвата DLL для Clementine Описание: Проблема в Clementine v.1.3.1 позволяет локальному злоумышленнику выполнить произвольный код с помощью специально созданного DLL-файла. Затронутая версия: Clementine v.1.3.1 Исследователь: Utkarsh r1971d3 LinkedIn Ссылка на CVE NIST:...

CVE-2010-5230

CVE-2010-5230 Множественные уязвимости ненадёжного пути поиска в MicroStation 7.1 позволяют локальным пользователям получить привилегии через троянские файлы 1 mptools.dll, 2 baseman.dll, 3 wintab32.dll или 4 wintab.dll в текущем рабочем каталоге, что продемонстрировано на примере каталога,...

CVE-2024-6473-PoC

CVE-2024-6473 PoC Yandex Browser pour ordinateur de bureau avant la version 24.7.1.380 présente une vulnérabilité de DLL Hijacking car un chemin de recherche non fiable est utilisé. Version vulnérable du navigateur !IMPORTANT La connexion Internet doit être désactivée pendant l'installation, sino...

CVE-2024-32019-ndsudo

Уязвимость ndsudo позволяет злоумышленнику получить права root, эксплуатируя ненадёжный путь поиска в инструменте ndsudo, который является частью Netdata Agent. Это может позволить выполнение произвольных программ с повышенными привилегиями, если злоумышленник поместит вредоносный бинарный файл в...

CVE-2026-87723: Untrusted Search Path

In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute arbitrary local code under the securit...

CVE-2026-68492

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...

CVE-2026-68492

The Plesk control panel is affected by an untrusted search path vulnerability in versions 18.0.34 to 18.0.80.7 , 18.0.81 to 18.0.81.0 , and specifically within the Plesk RESTful API extension from version 2.4.2 to 2.4.6 . This flaw allows remote authenticated users to achieve arbitrary code execu...

CVE-2026-68492

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...

EUVD-2026-85621

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...

CVE-2026-68492

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...

CVE-2026-68492: Untrusted Search Path

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: vim (UTSA-2023-002719)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002719 advisory. Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833. Tenable has extracted the preceding description block directly from the Unity Linux security...

EUVD-2026-74187

OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS...

OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS

Summary The OpenTelemetry.Resources.Host NuGet package is affected by an untrusted search path vulnerability on macOS. The host.id resource attribute detector launches the sh and ioreg executables by bare name rather than by absolute path, so both are resolved through the PATH environment variabl...

CVE-2026-92587: Untrusted Search Path

n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked git with that path as its working directory; git walked up to the enclosing repository's top level and resolv...

Astra Linux – Vulnerability in Mariadb 10.3

A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server up to 2021-03-03; and the wsrep patch up to 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUP...

Astra Linux – Vulnerability in Node.js

There is a vulnerability related to untrusted search paths in Node.js. Versions 19.6.1, 18.14.1, 16.19.1, and 14.21.3 may allow an attacker to search for data and potentially load ICU data when running with elevated privileges...

CVE-2026-81192

OpenTelemetry.Resources.Host NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability on macOS. Prior to version 1.16.0-beta.2, the host.id resource attribute detector launches the sh and ioreg executables by bare name rather...