#season-10
4 registros
-
Variatype
Git exposto com credenciais, path traversal + CVE-2025-66034 no fonttools, command injection no FontForge (CVE-2024-25082) e sudo os.path.join → root.
-
Facts
Camaleon CMS 2.9.0: mass assignment (CVE-2025-2304) vira admin, path traversal (CVE-2024-46987) lê a chave SSH e sudo facter dá root.
-
Pterodactyl
Pterodactyl Panel 1.11.10 LFI→RCE (CVE-2025-49132); privesc openSUSE: polkit allow_active (CVE-2025-6018) + libblockdev XFS nosuid (CVE-2025-6019).
-
Interpreter
Foothold por desserialização XStream no Mirth Connect 4.4.0 (CVE-2023-43208); root via f-string injection num eval() de script Flask rodando como root.