1772 matches found
CVE-2025-27512
CVE-2025-27512 affects Zincati’s polkit rule for Fedora CoreOS. A logic error in Zincati v0.0.24–v0.0.29 broadens access to the actions org.projectatomic.rpmostree1.deploy and org.projectatomic.rpmostree1.finalize-deployment to any unprivileged user with system D-Bus access, allowing deployment o...
Linux Distros Unpatched Vulnerability : CVE-2021-4115
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from this...
Linux Distros Unpatched Vulnerability : CVE-2018-1116
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in polkit before version 0.116. The implementation of the polkitbackendinteractiveauthoritycheckauthorization function in polkitd allows to tes...
CVE-2025-23222
An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, dde-api-proxy runs as root and forwards messages from arbitrary local users to legacy D-Bus methods in the actual D-Bus services, and the actual D-Bus servic...
CVE-2025-23222
Deepin dde-api-proxy (v1.0.19 and earlier) exposes a local privilege-escalation flaw: the daemon runs as root and forwards local user D-Bus requests to legacy D-Bus services, which do not detect the proxy context. This can allow unprivileged users to access D-Bus methods that should be restricted...
SUSE CVE-2025-23222
An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, dde-api-proxy runs as root and forwards messages from arbitrary local users to legacy D-Bus methods in the actual D-Bus services, and the actual D-Bus servic...
CVE-2016-2568 affecting package polkit 0.119-4
CVE-2016-2568 affecting package polkit 0.119-4. No patch is available currently...
CVE-2016-2568 affecting package polkit 0.116-7
CVE-2016-2568 affecting package polkit 0.116-7. No patch is available currently...
PT-2026-1887
Name of the Vulnerable Software and Affected Versions TLP versions prior to 1.9.1 TLP version 1.9.0 Description TLP version 1.9.0 introduces a profiles daemon that provides a D-Bus interface. A flaw exists in this daemon that allows local attackers to bypass Polkit authentication. This bypass is...
Amazon Linux 2022 : polkit, polkit-devel, polkit-libs (ALAS2022-2022-016)
It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-016 advisory. A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users accordin...
Fedora 41 : polkit (2024-d2e583eab4)
The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-d2e583eab4 advisory. Setting loglevels and target via LogControl now allowed to root only https://github.com/polkit-org/polkit/issues/506...
NetworkManager-libreswan: Local privilege escalation via leftupdown
A flaw was found in the libreswan client plugin for NetworkManager NetkworkManager-libreswan, where it fails to properly sanitize the VPN configuration from the local unprivileged user. In this configuration, composed by a key-value format, the plugin fails to escape special characters, leading t...
Updated networkmanager-libreswan packages fix security vulnerability
A flaw was found in the libreswan client plugin for NetworkManager NetkworkManager-libreswan, where it fails to properly sanitize the VPN configuration from the local unprivileged user. In this configuration, composed by a key-value format, the plugin fails to escape special characters, leading t...
[SECURITY] Fedora 41 Update: polkit-125-1.fc41.1
polkit is a toolkit for defining and handling authorizations. It is used for allowing unprivileged processes to speak to privileged processes...
NetworkManager-libreswan: Local privilege escalation via leftupdown
A flaw was found in the libreswan client plugin for NetworkManager NetkworkManager-libreswan, where it fails to properly sanitize the VPN configuration from the local unprivileged user. In this configuration, composed by a key-value format, the plugin fails to escape special characters, leading t...
NetworkManager-libreswan: Local privilege escalation via leftupdown
A flaw was found in the libreswan client plugin for NetworkManager NetkworkManager-libreswan, where it fails to properly sanitize the VPN configuration from the local unprivileged user. In this configuration, composed by a key-value format, the plugin fails to escape special characters, leading t...
NetworkManager-libreswan: Local privilege escalation via leftupdown
A flaw was found in the libreswan client plugin for NetworkManager NetkworkManager-libreswan, where it fails to properly sanitize the VPN configuration from the local unprivileged user. In this configuration, composed by a key-value format, the plugin fails to escape special characters, leading t...
CVE-2024-9050
A flaw was found in the libreswan client plugin for NetworkManager NetkworkManager-libreswan, where it fails to properly sanitize the VPN configuration from the local unprivileged user. In this configuration, composed by a key-value format, the plugin fails to escape special characters, leading t...
NetworkManager-libreswan: Local privilege escalation via leftupdown
A flaw was found in the libreswan client plugin for NetworkManager NetkworkManager-libreswan, where it fails to properly sanitize the VPN configuration from the local unprivileged user. In this configuration, composed by a key-value format, the plugin fails to escape special characters, leading t...
CVE-2024-9050 Networkmanager-libreswan: local privilege escalation via leftupdown
A flaw was found in the libreswan client plugin for NetworkManager NetkworkManager-libreswan, where it fails to properly sanitize the VPN configuration from the local unprivileged user. In this configuration, composed by a key-value format, the plugin fails to escape special characters, leading t...