CVE-2023-36476: Exposure of Sensitive Information to an Unauthorized Actor

calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users of calamares-nixos-extensions version 0.3.12 and prior who installed NixOS through the graphical calamares installer, with an unencrypted /boot, on either non-UEFI systems or with a LU...

PT-2023-25585 · Unknown · Calamares-Nixos-Extensions

Name of the Vulnerable Software and Affected Versions: calamares-nixos-extensions versions 0.3.12 and prior Description: The issue affects users of calamares-nixos-extensions who installed NixOS through the graphical calamares installer with an unencrypted /boot, on either non-UEFI systems or wit...

calamares-nixos-extensions 信息泄露漏洞

Calamares is a generic installer framework from the Calamares team. An information disclosure vulnerability exists in Calamares calamares-nixos-extensions version 0.3.12 and earlier, which stems from a user installing NixOS via the graphical calamares installer with an unencrypted /boot on a...

NixOS Nix CVE-2019-17365 Local Privilege Escalation Vulnerability

Description NixOS Nix is prone to a local privilege-escalation vulnerability. An attacker may exploit this issue to gain elevated privileges. Successful exploits may aid in further attacks. Nix versions through 2.3 are vulnerable. Technologies Affected NixOS Nix 1.0 NixOS Nix 1.5 NixOS Nix 1.9...

NixOS NixOS LDAP SSL Certificate Validation Default Vulnerability

NixOS is a distribution of the Linux system. A security vulnerability exists in NixOS 17.03 and earlier versions. A remote attacker can exploit this vulnerability to conduct a man-in-the-middle attack and steal a user's password hash or service account credentials in plaintext...

CVE-2017-11501

NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP. The users.ldap NixOS module implements user authentication against LDAP servers via a PAM module. It was found that if TLS is enabled to connect to the LDAP server with users.ldap.useTLS, peer...

Design/Logic Flaw

NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP. The users.ldap NixOS module implements user authentication against LDAP servers via a PAM module. It was found that if TLS is enabled to connect to the LDAP server with users.ldap.useTLS, peer...

CVE-2017-11501

NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP. The users.ldap NixOS module implements user authentication against LDAP servers via a PAM module. It was found that if TLS is enabled to connect to the LDAP server with users.ldap.useTLS, peer...

CVE-2017-11501

CVE-2017-11501 affects NixOS 17.03 and earlier via the users.ldap PAM module used for LDAP authentication. When TLS is used to connect to the LDAP server (users.ldap.useTLS), the peer certificate verification is unconditionally disabled in /etc/ldap.conf. This creates a risk of man-in-the-middle ...

CVE-2017-11501

NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP. The users.ldap NixOS module implements user authentication against LDAP servers via a PAM module. It was found that if TLS is enabled to connect to the LDAP server with users.ldap.useTLS, peer...

CVE-2017-11501: Improper Certificate Validation

NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP. The users.ldap NixOS module implements user authentication against LDAP servers via a PAM module. It was found that if TLS is enabled to connect to the LDAP server with users.ldap.useTLS, peer...

NixOS Local Elevation of Privilege Vulnerability

NixOS is a distribution of the Linux system. A security vulnerability exists in version 17.03 of NixOS prior to 17.03.887. A local attacker can exploit the vulnerability to gain privileges by executing the docker command...

Command injection

NixOS 17.03 before 17.03.887 has a world-writable Docker socket, which allows local users to gain privileges by executing docker commands...

CVE-2017-7412

NixOS 17.03 before 17.03.887 has a world-writable Docker socket, which allows local users to gain privileges by executing docker commands...

CVE-2017-7412

NixOS 17.03 before 17.03.887 has a world-writable Docker socket, which allows local users to gain privileges by executing docker commands...

CVE-2017-7412: Undefined Security Weakness

NixOS 17.03 before 17.03.887 has a world-writable Docker socket, which allows local users to gain privileges by executing docker commands...

CVE-2017-7412

NixOS 17.03 before 17.03.887 has a world-writable Docker socket, which allows local users to gain privileges by executing docker commands...

CVE-2017-7412

NixOS 17.03 before 17.03.887 is affected by CVE-2017-7412 due to a world-writable Docker socket, enabling local privilege escalation by any user operating docker commands. Root cause: insecure socket permissions. Impact: local privilege elevation with full system access (as described in NVD/CNVD/...