SUSE CVE-2024-36137

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to...

RHEL 7 : gvfs (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - gvfs: race condition in daemon/gvfsbackendadmin.c due to admin backend not implementing...

RHEL 5 : vim (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - vim: Integer overflow at an unserializeuep memory allocation site CVE-2017-6350 - vim before patch 8.0.00...

RHEL 7 : gvfs (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - gvfs: race condition in daemon/gvfsbackendadmin.c due to admin backend not implementing...

MGASA-2024-0162 Updated openpmix packages fix security vulnerability

This update fixes a race condition allowing attackers to obtain ownership of arbitrary files CVE-2023-41915...

Incorrect Permission Assignment For Critical Resource

github.com/git-ecosystem/git-credential-manager/ is vulnerable to Incorrect Permission Assignment For Critical Resource. The vulnerability is due to improper file ownership settings where Debian package does not set root ownership on installed files. This allows user 1001 on a multi-user system t...

Monero: [Monero wallet RPC] File precreation to file ownership and credentials leak

The Monero wallet RPC was found to have a vulnerability in the file creation process that could lead to potential credential leakage. The issue was located in the walletrpcserver::init method, where a file was created without using the OEXCL flag, allowing an attacker to pre-create the file and...

CVE-2024-26002

An improper input validation in the Qualcom plctool allows a local attacker with low privileges to gain root access by changing the ownership of specific files...

CVE-2024-26002 PHOENIX CONTACT: File ownership manipulation in CHARX Series

An improper input validation in the Qualcom plctool allows a local attacker with low privileges to gain root access by changing the ownership of specific files...

CVE-2024-26002 PHOENIX CONTACT: File ownership manipulation in CHARX Series

An improper input validation in the Qualcom plctool allows a local attacker with low privileges to gain root access by changing the ownership of specific files...

PHOENIX CONTACT CHARX SEC Input Validation Error Vulnerability

PHOENIX CONTACT CHARX SEC is a series of AC charge controllers from PHOENIX CONTACT, Germany. An input validation error vulnerability exists in PHOENIX CONTACT CHARX SEC-3000 v1.5.1 prior to v1.5.1, which stems from incorrect input validation and allows a low-privileged, local attacker to gain ro...

CVE-2024-27294 dp-golang Go installation could be owned by wrong user

dp-golang is a Puppet module for Go installations. Prior to 1.2.7, dp-golang could install files — including the compiler binary — with the wrong ownership when Puppet was run as root and the installed package was On macOS: Go version 1.4.3 through 1.21rc3, inclusive,...

PT-2024-21801 · Puppet +1 · Puppet +1

Name of the Vulnerable Software and Affected Versions: dp-golang versions prior to 1.2.7 Description: The issue arises when dp-golang is used to install Go, potentially leading to files being installed with incorrect ownership. This occurs when Puppet is run as root and the installed package is o...

CVE-2020-36770

pkgpostinst in the Gentoo ebuild for Slurm through 22.05.3 unnecessarily calls chown to assign root's ownership on files in the live root filesystem. This could be exploited by the slurm user to become the owner of root-owned files...

Design/Logic Flaw

pkgpostinst in the Gentoo ebuild for Slurm through 22.05.3 unnecessarily calls chown to assign root's ownership on files in the live root filesystem. This could be exploited by the slurm user to become the owner of root-owned files...

PT-2024-10822 · Gentoo +1 · Gentoo +1

Name of the Vulnerable Software and Affected Versions: Slurm versions through 22.05.3 Description: The issue arises from the pkg postinst in the Gentoo ebuild for Slurm, which unnecessarily calls chown to assign root's ownership on files in the live root filesystem. This could be exploited by the...

CVE-2020-36770

Affected software: Slurm ( Gentoo ebuild ). Issue: the pkg_postinst script for Slurm up to version 22.05.3 runs chown to assign root ownership on files in the live root filesystem. Root-owned files could be taken over by the slurm user, per the description in CVE-2020-36770. Root cause: unnecessa...

CVE-2023-46157

File-Manager in MGT CloudPanel 2.0.0 through 2.3.2 allows the lowest privilege user to achieve OS command injection by changing file ownership and changing file permissions to 4755...

CVE-2023-46157

File-Manager in MGT CloudPanel 2.0.0 through 2.3.2 allows the lowest privilege user to achieve OS command injection by changing file ownership and changing file permissions to 4755...

Command injection

File-Manager in MGT CloudPanel 2.0.0 through 2.3.2 allows the lowest privilege user to achieve OS command injection by changing file ownership and changing file permissions to 4755...