1783 matches found
USN-8701-1: UDisks vulnerability
It was discovered that UDisks did not correctly validate the caller identity when handling the as-user option in the org.freedesktop.UDisks2.Filesystem.Mount D-Bus method. A local attacker with an active console session could possibly use this issue to mount filesystems on behalf of arbitrary...
SUSE-SU-2026:23405-1 Security update for udisks2
This update for udisks2 fixes the following issue: - CVE-2026-7867: insufficient authorization checks on the as-user option in the org.freedesktop.UDisks2.Filesystem.Mount D-Bus method can lead to local privilege escalation bsc1274430...
OPENSUSE-SU-2026:21704-1 Security update for udisks2
This update for udisks2 fixes the following issue: - CVE-2026-7867: insufficient authorization checks on the as-user option in the org.freedesktop.UDisks2.Filesystem.Mount D-Bus method can lead to local privilege escalation bsc1274430...
NimbusPWN-CVE-2022-29799-29800
🛡️ NimbusPWN-CVE-2022-29799-29800 – Testen lokaler Privilegienausweitungs-Sicherheitslücken 📖 Über dieses Werkzeug Diese Software hilft Sicherheitsforschern, zwei spezifische Schwachstellen zu untersuchen, die als CVE-2022-29799 und CVE-2022-29800 bekannt sind. Diese Fehler existieren in der...
CVE-2026-81704
opensslencrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faste...
CVE-2026-81686
opensslencrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations to...
EUVD-2026-67060
opensslencrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faste...
CVE-2026-81704 openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus
opensslencrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faste...
CVE-2026-81704
openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler. The affected code uses unstretched SHA-256 instead of Argon2id , omitting key stretching and hash rounds. This allows attackers to perform offline password guessing ag...
CVE-2026-81704 openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus
opensslencrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faste...
CVE-2026-81686 openssl_encrypt before 1.4.9 D-Bus Properties Authorization Bypass
opensslencrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations to...
EUVD-2026-67042
opensslencrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations to...
CVE-2026-81686 openssl_encrypt before 1.4.9 D-Bus Properties Authorization Bypass
opensslencrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations to...
CVE-2026-81686
openssl_encrypt 1.4.x before 1.4.9 ships an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can set MaxConcurrentOperations to 0/negative (blocking all subsequent op...
PT-2026-82605
Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The D-Bus CryptoService.EncryptFile handler uses unstretched SHA-256 instead of Argon2id for key derivation. This allows attackers to perform offline password guessing against encrypted files...
CentOS 9 : glib2-2.68.4-29.el9
The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the glib2-2.68.4-29.el9 build changelog. - heap under-read in gkeyfilegetlocalestringlist CVE-2026-58014 - limit D-Bus auth line read length CVE-2026-15588 - off-by-one error in...
Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.5.1.12)
The version of AOS installed on the remote host is prior to 7.5.1.12. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.5.1.12 advisory. - A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml in the gio/gdbusintrospection.c file...
CVE-2026-61898
A flaw was found in accountsservice. A local attacker can exploit this by injecting arbitrary shell commands into the user-controlled LANGUAGE entry in the /.pamenvironment file. The Ubuntu-specific language helper scripts process this input unescaped, leading to arbitrary code execution with roo...
Astra Linux – Vulnerability in Dbus
A issue was discovered in D-Bus before 1.12.24, 1.13.x, and 1.14.x, before 1.14.4, and 1.15.x, before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message where the array length is inconsistent with the size of the element...
CVE-2026-61898
The Ubuntu-specific language helper scripts save-to-pam-env, update-langlist shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in /.pamenvironment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an...