MaherAzzouzi

8 exploits Active since Jan 2022
CVE-2022-37706 NOMISEC HIGH WORKING POC
Ubuntu Enlightenment Mount Priv Esc
enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring.
323 stars
CVSS 7.8
CVE-2022-23967 NOMISEC WORKING POC
Rejected
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-15679. Reason: This candidate is a duplicate of CVE-2019-15679. Notes: All CVE users should reference CVE-2019-15679 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
16 stars
CVE-2024-26817 NOMISEC MEDIUM WRITEUP
Linux Kernel Integer Overflow via amdkfd Memory Allocation
In the Linux kernel, the following vulnerability has been resolved: amdkfd: use calloc instead of kzalloc to avoid integer overflow This uses calloc instead of doing the multiplication which might overflow.
7 stars
CVSS 5.5
CVE-2022-37704 NOMISEC MEDIUM WRITEUP
Amanda 3.5.1 - Privilege Escalation via rundump SUID Binary
Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which may lead to escalation of privileges, denial of service, and information disclosure.
3 stars
CVSS 6.7
CVE-2022-37705 NOMISEC MEDIUM WORKING POC
Amanda 3.5.1 - Privilege Escalation via runtar SUID Argument Injection
A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar with specific arguments that are controllable by the attacker. This program mishandles the arguments passed to tar binary (it expects that the argument name and value are separated with a space; however, separating them with an equals sign is also supported),
3 stars
CVSS 6.7
CVE-2022-37703 NOMISEC LOW WRITEUP
Amanda 3.5.1 - Directory Existence Disclosure via calcsize SUID Binary
In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use `opendir()` as root directly without checking the path, letting the attacker provide an arbitrary path.
3 stars
CVSS 3.3
CVE-2022-37706 NOMISEC HIGH WORKING POC
Ubuntu Enlightenment Mount Priv Esc
enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring.
2 stars
CVSS 7.8
CVE-2022-47952 NOMISEC LOW WRITEUP
lxc < 5.0.1 - Information Disclosure via lxc-user-nic Error Messages
lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected directory tree, because "Failed to open" often indicates that a file does not exist, whereas "does not refer to a network namespace path" often indicates that a file exists. NOTE: this is different from CVE-2018-6556 because the CVE-2018-6556 fix design was based on the premise that "we will report back to the user that the open() failed but the user has no way of knowing why it failed"; however, in many realistic cases, there are no plausible reasons for failing except that the file does not exist.
CVSS 3.3