convert2rhel: Red Hat account password passed via command line by code

There is a flaw in convert2rhel. convert2rhel passes the Red Hat account password to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the password via the process command line via e.g. htop or ps. The specific impact varies upon the...

Oracle Linux 8 : kernel (ELSA-2022-1550)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-1550 advisory. - RDMA/cma: Do not change route.addr.srcaddr.ssfamily Kamal Heib 2032073 2032074 CVE-2021-4028 - netfilter: nftablesoffload: incorrect flow offload...

mariadb: improper locking due to unreleased lock in the ds_xbstream.cc

MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/dsxbstream.cc, when an error occurs streamctxt-destfile == NULL while executing the method xbstreamopen, the held lock is not released correctly, which allows local users to trigger a denial of service due to the...

Huawei EulerOS: Security Advisory for aide (EulerOS-SA-2022-1421)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2022-2389 · Red Hat · Convert2Rhel

Name of the Vulnerable Software and Affected Versions: convert2rhel affected versions not specified Description: The issue is related to a flaw in convert2rhel, where it passes the Red Hat account password to subscription-manager via the command line. This could allow unauthorized users locally o...

Privilege escalation

A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 Servers. The vulnerability could be locally exploited to allow an user with Administrator access to escalate their privilege. The vulnerability is resolved in the latest firmware update. HPE...

CVE-2021-42255

AppGuard Enterprise before 6.7.100.1 creates a Temporary File in a Directory with Insecure Permissions. Local users can gain SYSTEM privileges because a repair operation relies on the %TEMP% directory of an unprivileged user...

Directory traversal

AppGuard Enterprise before 6.7.100.1 creates a Temporary File in a Directory with Insecure Permissions. Local users can gain SYSTEM privileges because a repair operation relies on the %TEMP% directory of an unprivileged user...

CVE-2021-42255

CVE-2021-42255 affects BeyondTrust AppGuard Enterprise (pre-6.7.100.1). The vulnerability arises because the repair operation uses a Temporary File created in a directory with insecure permissions in the unprivileged user’s %TEMP% folder, enabling local users to escalate to SYSTEM privileges. CVS...

CVE-2021-42255

AppGuard Enterprise before 6.7.100.1 creates a Temporary File in a Directory with Insecure Permissions. Local users can gain SYSTEM privileges because a repair operation relies on the %TEMP% directory of an unprivileged user...

Design/Logic Flaw

Ivanti DSM Remote = 6.3.1.1862 is vulnerable to an unquoted service path allowing local users to launch processes with elevated privileges...

CVE-2022-27088

Ivanti DSM Remote = 6.3.1.1862 is vulnerable to an unquoted service path allowing local users to launch processes with elevated privileges...

CVE-2022-27052

FreeFtpd version 1.0.13 and below contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges...

CVE-2022-27052

FreeFtpd (version 1.0.13 and earlier) is affected by an unquoted service path that lets local users launch elevated processes. Root cause is an unquoted service path in the FreeFtpd service executable; impact is local privilege elevation with complete confidentiality/ integrity/availability impli...

CVE-2022-27052

FreeFtpd version 1.0.13 and below contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges...

CVE-2021-22572 Data-transfer-project information disclosure via tmp directory

On unix-like systems, the system temporary directory is shared between all users on that system. The root cause is File.createTempFile creates files in the the system temporary directory with world readable permissions. Any sensitive information written to theses files is visible to all other loc...

Microsoft Windows CSRSS Security Feature Bypass Vulnerability

The Client-Server Run-time Subsystem CSRSS in Microsoft mismanages process tokens, which allows local users to gain privileges via a crafted application...

Microsoft Windows Kernel Privilege Escalation Vulnerability

The kernel in Microsoft Windows allows local users to gain privileges via a crafted application...

Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability

afd.sys in the Ancillary Function Driver in Microsoft Windows does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application...

mariadb: DoS due to improper locking due to unreleased lock in plugin/server_audit/server_audit.c

MariaDB Server before 10.7 is vulnerable to Denial of Service. While executing the plugin/serveraudit/serveraudit.c method logstatementex, the held lock lockbigbuffer is not released correctly, which allows local users to trigger a denial of service due to the deadlock...