316 matches found
CVE-2025-3528
CVE-2025-3528 describes a local privilege escalation in OpenShift Mirror Registry due to the quay-app container having write access to /etc/passwd. Affected component: Mirror Registry (quay-app container) within OpenShift; root cause: improper file permissions enabling an attacker with container ...
PT-2025-20554
Name of the Vulnerable Software and Affected Versions OpenShift Mirror Registry affected versions not specified Description A flaw was found in the Mirror Registry. The quay-app container shipped as part of the Mirror Registry for OpenShift has write access to the /etc/passwd file. This flaw allo...
Ensure That User Group and Password File Permissions Are Correct
In the Linux OS-related information, such as users, passwords, and user groups, is recorded in the configuration files in the /etc directory. Proper permissions must be set for accessing these files. Otherwise, the files may be stolen or tampered with by attackers. The owner and owner group of...
CVE-2025-2920 Netis WF-2404 passwd weak hash
A vulnerability was found in Netis WF-2404 1.1.124EN. It has been rated as problematic. This issue affects some unknown processing of the file /еtc/passwd. The manipulation leads to use of weak hash. It is possible to launch the attack on the physical device. The complexity of an attack is rather...
CVE-2025-2920 Netis WF-2404 passwd weak hash
A vulnerability was found in Netis WF-2404 1.1.124EN. It has been rated as problematic. This issue affects some unknown processing of the file /еtc/passwd. The manipulation leads to use of weak hash. It is possible to launch the attack on the physical device. The complexity of an attack is rather...
PT-2025-13559 · Netis · Netis Wf-2404
Name of the Vulnerable Software and Affected Versions: Netis WF-2404 version 1.1.124EN Description: A critical issue has been discovered, affecting an unknown function of the file /etc/passwd. The manipulation with the input Realtek leads to the use of a default password. It is possible to launch...
CVE-2025-2349
A vulnerability was found in IROAD Dash Cam FX2 up to 20250308. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /etc/passwd of the component Password Hash Handler. The manipulation leads to password hash with insufficient computational...
PT-2024-35730 · Unknown · Invoice Ninja
Name of the Vulnerable Software and Affected Versions: Invoice Ninja affected versions not specified Description: A Server-Side Request Forgery SSRF issue has been discovered in Invoice Ninja, an open-source invoicing platform. This flaw could allow attackers to access sensitive files, posing...
Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS)
A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace...
Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS)
A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace...
PT-2024-30674 · Kieback & Peter · Kieback & Peter'S Ddc4000 Series
Name of the Vulnerable Software and Affected Versions: Kieback & Peter's DDC4000 series affected versions not specified Description: The issue is related to insufficiently protected credentials, which may allow an unauthenticated attacker with access to /etc/passwd to read the password hashes of...
AZL-50614 CVE-2024-9676 affecting package buildah for versions less than 1.41.4-2
A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace...
UBUNTU-CVE-2024-9676
A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace...
CVE-2024-6331
stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f is vulnerable to Local File Read LFI by Prompt Injection. The integration of Google Gimini 1.0 Pro with HarmBlockThreshold.BLOCKNONE for HarmCategory.HARMCATEGORYHATESPEECH and HarmCategory.HARMCATEGORYHARASSMENT i...
PT-2024-37183 · Stitionai · Devika +1
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue allows an attacker to access sensitive files on the server by providing incorrect file names, which the agent attempts to correct, inadvertently revealing the content of t...
PT-2024-4264 · D Link · D-Link Dir-605L
Name of the Vulnerable Software and Affected Versions: D-Link DIR-605L version 2.13B01 Description: A hardcoded password vulnerability was discovered in the /etc/passwd component of the D-Link DIR-605L router's firmware. This issue allows attackers to log in as root, potentially granting them ful...
RHEL 5 : libuser (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - libuser: TOCTOU race conditions by copying and removing directory trees CVE-2012-5630 - libuser: Security...
PT-2024-29472 · Skylab · Skylab Igx Iiot Gateway
Name of the Vulnerable Software and Affected Versions: Skylab IGX IIoT Gateway affected versions not specified Description: The Skylab IGX IIoT Gateway has a security issue where the limited shell terminal process runs under root privileges, allowing an attacker to read, write, and modify any fil...
The vulnerability of the CRI-O Container Engine’s application programming interface allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the CRI-O Container Engine’s application programming interface, a software platform for managing clusters of virtual machines in Kubernetes, stems from the ability to add arbitrary strings to the /etc/passwd file using a specially created environment variable. Exploiting this...