PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2021-33214] eCatcher Desktop, Version 6.6.4 Advisory

bishopfox.com | vulnerability | CVE-2021-33214 | #privilege-escalation | #vulnerability | #advisory | #vpn | #ecatcher | #cve-2021-33214
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Advisory on CVE-2021-33214 in eCatcher 6.6.4 and earlier: a world-writable service temp directory lets a local attacker swap in a rogue OpenVPN config for privilege escalation; fixed in 6.7.3.
CVE
CVE-2021-33214
Published
Collected

Related coverage

vulnerability · blog.quarkslab.com
Cato VPN Client: Split-Tunnel and Privilege Escalation (CVE-2026-10739)
Local privilege escalation in the Cato VPN Client through the split-tunnel upload flow, from named pipe to SYSTEM delete and Windows Installer rollback.
High · vulnerability · codeberg.org
cowcups: CUPS cups-fontpath Local Privilege Escalation (LPE) to Root PoC
Demonstrates an effective local root privilege escalation chain in default CUPS environments by abusing printer discovery and Ghostscript font search paths.
vulnerability · volexity.com
[CVE-2026-104935] A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
# A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days October 13, 2026 Charlie Gardner, Sean Koessel, Steven Adair, and Volexity Volcano Team **_Volexity...
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
High · vulnerability · bishopfox.com
strongSwan CVE-2026-25075: Integer Underflow in VPN Authentication
Bishop Fox exploited CVE-2026-25075, an integer underflow in strongSwan's EAP-TTLS plugin (4.5.0-6.0.4): crafted messages crash the IKE daemon via two-phase heap corruption; upgrade to 6.0.5+.
vulnerability · bishopfox.com
Oracle WebLogic Node Manager allows arbitrary configuration via UNC path
Bishop Fox advisory: WebLogic Node Manager 10.3.3 and earlier let unauthenticated attackers redirect its config and password files to an attacker-controlled UNC path, then run commands; fixed in 2011.
Back