CVE-2023-1250

Improper Input Validation vulnerability in OTRS AG OTRS ACL modules, OTRS AG OTRS Community Edition ACL modules allows Local Execution of Code. When creating/importing an ACL it was possible to inject code that gets executed via manipulated comments and ACL-names This issue affects OTRS: from 7.0...

UBUNTU-CVE-2023-1250

Improper Input Validation vulnerability in OTRS AG OTRS ACL modules, OTRS AG OTRS Community Edition ACL modules allows Local Execution of Code. When creating/importing an ACL it was possible to inject code that gets executed via manipulated comments and ACL-names This issue affects OTRS: from 7.0...

CVE-2023-1250 Code execution through ACL creation

Improper Input Validation vulnerability in OTRS AG OTRS ACL modules, OTRS AG OTRS Community Edition ACL modules allows Local Execution of Code. When creating/importing an ACL it was possible to inject code that gets executed via manipulated comments and ACL-names This issue affects OTRS: from 7.0...

CVE-2023-1250 Code execution through ACL creation

Improper Input Validation vulnerability in OTRS AG OTRS ACL modules, OTRS AG OTRS Community Edition ACL modules allows Local Execution of Code. When creating/importing an ACL it was possible to inject code that gets executed via manipulated comments and ACL-names This issue affects OTRS: from 7.0...

CVE-2023-1250

OTRS/OTRS Community Edition vulnerable to improper input validation in ACL modules, enabling local code execution via manipulated comments and ACL-names. Affected: OTRS 7.0.x before 7.0.42, 8.0.x before 8.0.31; CE 6.0.1 through 6.0.34. Remediation: upgrade to 7.0.42+ (or later), 8.0.31+ (or later...

OESA-2023-1159 pesign security update

pesign is a command line tool for manipulating signatures and cryptographic digests of UEFI applications. Security Fixes: A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc/pki/pesign and...

SUSE SLES12 Security Update : perl-Net-Server (SUSE-SU-2023:0759-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:0759-1 advisory. - CVE-2013-1841: Fixed insufficient hostname access checking bsc808830. Tenable has extracted the preceding description block directly from...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : perl-Net-Server (SUSE-SU-2023:0746-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:0746-1 advisory. - CVE-2013-1841: Fixed insufficient hostname access checking bsc808830. Tenable has extracted the precedi...

Privilege Escalation

github.com/hashicorp/nomad is vulnerable to Privilege Escalation. A remote attacker with the submit-job ACL permission is able to escalate to management-level privileges using the workload identity and task API by submitting a job without ACL policies...

Information Disclosure

github.com/hashicorp/nomad is vulnerable to Information Disclosure. The vulnerability is due to the ACL system failing to block access to sensitive information from remote authenticated attackers because the deny ACL capability could be bypassed exposing the workload's own variables...

GHSA-RQM8-Q8J9-662F Nomad Job Submitter Privilege Escalation Using Workload Identity

Summary A vulnerability was identified in Nomad and Nomad Enterprise “Nomad” such that a user with the submit-job ACL capability can submit a job that can escalate to management-level privileges. This vulnerability, CVE-2023-1299, was introduced in Nomad 1.5.0 and fixed in Nomad 1.5.1. Background...

Nomad Job Submitter Privilege Escalation Using Workload Identity

Summary A vulnerability was identified in Nomad and Nomad Enterprise “Nomad” such that a user with the submit-job ACL capability can submit a job that can escalate to management-level privileges. This vulnerability, CVE-2023-1299, was introduced in Nomad 1.5.0 and fixed in Nomad 1.5.1. Background...

PT-2023-16871 · Hashicorp · Hashicorp Nomad +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Nomad and Nomad Enterprise version 1.5.0 Description: A job submitter can escalate to management-level privileges using workload identity and task API. This issue was introduced due to the exposure of the workload identity token to...

PT-2023-16869 · Hashicorp +1 · Nomad Enterprise +2

Name of the Vulnerable Software and Affected Versions: HashiCorp Nomad and Nomad Enterprise versions 1.4.0 through 1.5.0 Description: A vulnerability was identified in Nomad and Nomad Enterprise such that a deny ACL capability could not be applied to a workload’s own variables. If included, the...

Consul Server Panic when Ingress and API Gateways Configured with Peering Connections

A vulnerability was identified in Consul and Consul Enterprise “Consul” an authenticated user with service:write permissions could trigger a workflow that causes Consul server and client agents to crash under certain circumstances. To exploit this vulnerability, an attacker requires access to an...

GHSA-WJ6X-HCC2-F32J Consul Server Panic when Ingress and API Gateways Configured with Peering Connections

A vulnerability was identified in Consul and Consul Enterprise “Consul” an authenticated user with service:write permissions could trigger a workflow that causes Consul server and client agents to crash under certain circumstances. To exploit this vulnerability, an attacker requires access to an...

Debian: Security Advisory (DSA-1976-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Linux 7 : pesign (ELSA-2023-1093)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-1093 advisory. 0.109-11.0.1 - RPM macro fix Petr Benes - updates for Oracle Linux test certificate Alexey Petrenko - update Oracle Linux certificates Alexey Petrenko 0.109-11 ...

pesign: Local privilege escalation on pesign systemd service

A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc/pki/pesign and /run/pesign directories to grant access privileges to users in the 'pesign' group. However, the script doesn't check for...

pesign: Local privilege escalation on pesign systemd service

A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc/pki/pesign and /run/pesign directories to grant access privileges to users in the 'pesign' group. However, the script doesn't check for...