632 matches found
CVE-2022-37705
A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar with specific arguments that are controllable by the attacker. This program mishandles the...
Fedora 38 : amanda (2023-3d0619d767)
The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-3d0619d767 advisory. Update to version 3.5.3, which contains fixes for three minor security issues as well as other minor bugfixes...
openSUSE 15 Security Update : amanda (openSUSE-SU-2023:0069-1)
The remote openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0069-1 advisory. - A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges. The vulnerable component is the...
SUSE CVE-2012-6647
The futexwaitrequeuepi function in kernel/futex.c in the Linux kernel before 3.5.1 does not ensure that calls have two different futex addresses, which allows local users to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified other impact via a crafted...
SUSE CVE-2014-9749
Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote authenticated users to retain access by leveraging a stale nonce, aka "Nonce replay vulnerability."...
SUSE CVE-2019-18902
A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-3.5.1...
SUSE CVE-2020-26298
Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the :escapehtml opti...
SUSE CVE-2021-36976
libarchive 3.4.1 through 3.5.1 has a use-after-free in copystring called from douncompressblock and processblock...
SUSE CVE-2022-37703
In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use opendir as root directly without checking the path, letting the attacker provide an...
PT-2023-13547 · Amanda +2 · Amanda +2
Name of the Vulnerable Software and Affected Versions: Amanda version 3.5.1 Description: The issue allows privilege escalation from a regular user backup to root. A SUID binary located at /lib/amanda/rundump executes /usr/sbin/dump as root with controlled arguments from the attacker, which may le...
CVE-2022-37704
Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which may lead to escalation of privileges, denial of service, and information disclosure...
CVE-2022-37705
A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar with specific arguments that are controllable by the attacker. This program mishandles the...
CVE-2022-3064 affecting package etcd 3.5.1-6
CVE-2022-3064 affecting package etcd 3.5.1-6. An upgraded version of the package is available that resolves this issue...
PT-2022-27703 · Alist · Alist
Name of the Vulnerable Software and Affected Versions: Alist version 3.4.0 Description: The issue allows a user with only file upload permission to upload any file to any folder, including those that are password protected. Recommendations: For Alist version 3.4.0, update to version 3.5.1 to...
PT-2022-27706 · Alist · Alist
Name of the Vulnerable Software and Affected Versions: Alist version 3.5.1 Description: The issue is related to Cross Site Scripting XSS via the bulletin board. This means an attacker could potentially inject malicious scripts into the website, affecting users who access the bulletin board...
CVE-2022-45970
Alist v3.5.1 is vulnerable to Cross Site Scripting XSS via the bulletin board...
Alist 跨站脚本漏洞
Alist is a file listing program with multi-storage support by the individual developer Xhofe in China. A security vulnerability exists in Alist version v3.5.1, which originates from a cross-site scripting attack XSS vulnerability via the bulletin board...
OpenRazer 缓冲区错误漏洞
OpenRazer is an open source driver and userspace daemon. It is used to control Razer lighting and other features on GNU/Linux. A buffer error vulnerability exists in OpenRazer versions prior to v3.5.1, which can be exploited by an attacker to disclose the stack address of razerattrreaddpistages,...
PT-2022-16009 · Openrazer +1 · Openrazer +1
Name of the Vulnerable Software and Affected Versions: OpenRazer versions prior to 3.5.1 Description: OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. Using a modified USB device, an attacker can leak stack addresses of the...
