CVE-2025-4517-PoC

CVE-2025-4517-PoC CVE-2025-4517 是 Python tarfile 模块中的一个漏洞，允许在解压不受信任的 tar 归档文件时，在提取目录之外写入任意文件。该问题出现在使用 TarFile.extract 或 TarFile.extractall 并指定 filter="data" 或 filter="tar" 时，后者无法完全阻止通过精心构造的 tar 成员进行的路径遍历攻击。 Python 3.14 将默认提取过滤器更改为 "data"，因此依赖此默认值的应用程序也可能受到影响。虽然源代码分发的安装不受显著影响，但任何使用这些过滤器解压不受信任 tar...

watchTowr-vs-BMC-Footprints-RCE-CVE-2025-71257-CVE-2025-71260

CVE-2025-71257 y CVE-2025-71260 Cadena de Ejecución Remota de Código Pre-Autenticada en BMC FootPrints Herramienta Generadora de Artefactos de Detección de la Cadena de Ejecución Remota de Código Pre-Autenticada en BMC FootPrints Descripción Este Generador de Artefactos de Detección verifica si l...

varlib-cve-2025-66034

Exploit de fontTools varLib CVE-2025-66034 Este repositorio no introduce una nueva vulnerabilidad. Este es un exploit de prueba de concepto para CVE-2025-66034 que afecta al pipeline de generación de fuentes variables varLib de fontTools. La vulnerabilidad permite a los atacantes controlar el...

CVE-2026-19185

The system-call verifier for i3cdoccc in drivers/i3c/i3chandlers.c validated the outer struct i3ccccpayload, the broadcast ccc.data buffer and the targets.payloads array, but did not validate the per-target data buffers those array elements point at. Each struct i3cccctargetpayload carries its ow...

CVE-2026-103511

Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory...

CVE-2026-103507

Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can write arbitrary files on the host, potentially leading to code execution as the P4 Search service account...

CVE-2020-1206

En la vulnerabilidad SMBGhost CVE-2020-0796 hablé sobre una técnica de primitiva write-what-where mediante el uso de una vulnerabilidad de desbordamiento de enteros para cambiar el puntero Alloc.Userbuffer para que apunte a una dirección deseada y escribir datos arbitrarios en ella. Al igual que...

CVE-2026-2796-and-CVE-2026-2768-escape-the-wasm-box

CVE-2026-2796 + CVE-2026-2768 — Escapa de la caja de Wasm Investigación sobre explotación de Firefox de cadena completa: una confusión de tipos en WebAssembly para ejecución de código en el renderer , encadenada hacia un bug del proceso padre para un escape del sandbox. Ambos bugs se corrigieron ...

CVE-2026-103511 Arbitrary file-write via extension installation in P4Search

Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory...

EUVD-2026-92311

Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory...

CVE-2026-103511

Prior to version 2026.4.2 , Perforce P4 Search is vulnerable to an arbitrary file-write flaw. The software fails to validate file names provided to its extension installation feature . An attacker possessing super-user or service-token privileges can exploit this to write files containing arbitra...

CVE-2017-1000117

Repositorio PoC para CVE-2017-1000117 de VulApps Bifurcado desde joernchen/CVE-2017-1000117 git clone --recursive https://github.com/Jerry-zhuang/CVE-2017-1000117.git escribirá la salida de id en un archivo vul en /var/www/html. Ver más en VulApps...

CVE-2026-31431_je_sappelle_RoOt

CVE-2026-31431 - Copy Fail - Je s'appelle ROOT ! 📌 Objetivo del repositorio Este repositorio documenta la vulnerabilidad CVE-2026-31431 , apodada Copy Fail , y propone un procedimiento de remediación defensiva para sistemas Linux potencialmente expuestos. ⚠️ Este repositorio está estrictamente...

CVE-2026-103507

Perforce P4 Search versions prior to 2026.4.2 are vulnerable to an arbitrary file-write flaw because the software fails to restrict file paths through its logging configuration interface . An attacker possessing a service authentication token can write arbitrary files to the host, which may lead ...

EUVD-2026-92299

Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can write arbitrary files on the host, potentially leading to code execution as the P4 Search service account...

CVE-2026-103507 Arbitrary file-write via log configuration path in P4Search

Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can write arbitrary files on the host, potentially leading to code execution as the P4 Search service account...

CVE-2026-104805 Mitel MiVoice Office 400 Backup Restoration Arbitrary File Write Leading to Root Code Execution

DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration. The specific flaw exists within the backup restoration mechanism, which fai...

CVE-2026-104805

The Mitel MiVoice Office 400 system contains a vulnerability in its backup restoration functionality that allows for arbitrary file write . The flaw arises because the system fails to validate paths, file types, integrity, and authenticity of files within a TGZ archive before extraction, notably ...

CVE-2026-105248

A security flaw has been discovered in vgmstream up to r2117. This affects the function parseparams/txtpparse of the file src/meta/txtpparser.c of the component TXTP File Handler. The manipulation results in out-of-bounds write. The attack may be launched remotely. The patch is identified as...

cve-2024-32002-poc-aw

CVE-2024-32002 PRC AW 一个针对 CVE-2024-32002 的 POC，演示了对 .git 目录的任意写入。 请参阅相关的子模块仓库：cve-2024-32002-submodule-aw 本仓库包含的内容 一个指向 .git 目录的符号链接，其名称是任意的。 一个定义恶意子模块的 .gitmodules 文件。 如何重新创建此仓库 此仓库是在 Linux（具体来说是 WSL2）上创建的。这一点很重要，恶意仓库只能在大小写敏感的文件系统上创建。 1. 创建一个符号链接，全部使用小写字符 ln -s .git submodule 注： 符号链接应指向 .git...