14610 matches found
USN-7677-1 cloud-init vulnerabilities
Harry Sintonen discovered that the hotplugd socket in cloud-init was world writable. An attacker could possibly use this issue to send hotplug-hook commands. CVE-2024-11584 It was discovered that cloud-init granted root access to a hardcoded URL with a local IP address when a non-x86 platform is...
USN-7677-1: cloud-init vulnerabilities
Harry Sintonen discovered that the hotplugd socket in cloud-init was world writable. An attacker could possibly use this issue to send hotplug-hook commands. CVE-2024-11584 It was discovered that cloud-init granted root access to a hardcoded URL with a local IP address when a non-x86 platform is...
CVE-2025-53695
OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access 'root' user to the device firmware...
CVE-2025-53695
OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access 'root' user to the device firmware...
PT-2025-31108 · Unknown · Istar Ultra
Name of the Vulnerable Software and Affected Versions: iSTAR Ultra products affected versions not specified Description: An OS Command Injection issue exists in the iSTAR Ultra products web application. An authenticated attacker can exploit this to gain privileged access, specifically 'root' user...
sudo_inject
Linux Privilege Escalation by injecting process possessing sudo tokens Inject process that have valid sudo token and activate our own sudo token Introduction We all noticed that sometimes sudo doesn't ask us for a password because he remembers us. How does he remember us and how does he identifie...
CVE-2025-29630
Gardyn Home Kit Firmware allows a remote attacker with the corresponding ssh private key to achieve remote root access...
MGASA-2025-0213 Updated sudo packages fix security vulnerabilities
CVE-2025-32462 - Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines CVE-2025-32463 - Sudo before 1.9.17p1 allows local users to obtain root access because...
Updated sudo packages fix security vulnerabilities
CVE-2025-32462 - Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines CVE-2025-32463 - Sudo before 1.9.17p1 allows local users to obtain root access because...
CVE-2025-29630
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue; there is no indication that an applicable SSH private key has ever been compromised. Notes: none...
CVE-2017-20198
The Marathon UI in DC/OS 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers. Due to improper restriction of volume mount configurations, attackers can deploy a container that mounts the host's root filesystem / with read/write privileges. When using a malicious Docker image,...
NewStart CGSL MAIN 7.02 : libblockdev Vulnerability (NS-SA-2025-0117)
The remote NewStart CGSL host, running version MAIN 7.02, has libblockdev packages installed that are affected by a vulnerability: - A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the allowactive setting in Polkit permits a physically present user to take...
CVE-2025-29630
...
PT-2025-31211 · Undefined · Undefined
Sitecore Experience Platform XP prior to 8.0 Initial Release rev. 141212 and Content Management System CMS prior to 7.2 Update-3 rev. 141226 and prior to 7.5 Update-1 rev. 150130 contain a vulnerability that may allow an attacker to download files under the web root of the site when the name of t...
编号撤回
Gardyn 4 is a home vertical hydroponic growing system from Gardyn USA. A security vulnerability exists in Gardyn 4, which originates from a remote attacker being able to gain root access to an affected device via the corresponding ssh private key...
NewStart CGSL MAIN 7.02 : cups Multiple Vulnerabilities (NS-SA-2025-0113)
The remote NewStart CGSL host, running version MAIN 7.02, has cups packages installed that are affected by multiple vulnerabilities: - Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow a...
CVE-2025-41240 Mounted Kubernetes Secrets under a predictable path located within the web server document root
Three Bitnami Helm charts mount Kubernetes Secrets under a predictable path /opt/bitnami//secrets that is located within the web server document root. In affected versions, this can lead to unauthenticated access to sensitive credentials via HTTP/S. A remote attacker could retrieve these secrets ...
The vulnerability of Cloudflare WARP VPN service for the macOS operating system, related to insecure privilege management. Exploiting this vulnerability can allow attackers to elevate their privileges to the root level.
The vulnerability of Cloudflare WARP VPN service for macOS relates to insecure management of privileges. Exploiting this vulnerability could allow an attacker to elevate their privileges to the root level...
CVE-2016-15045
A local privilege escalation vulnerability exists in lastore-daemon, the system package manager daemon used in Deepin Linux developed by Wuhan Deepin Technology Co., Ltd.. In versions 0.9.53-1 Deepin 15.5 and 0.9.66-1 Deepin 15.7, the D-Bus configuration permits any user in the sudo group to invo...