14254 matches found
sudo_inject
Linux Privilege Escalation by injecting process possessing sudo tokens Inject process that have valid sudo token and activate our own sudo token Introduction We all noticed that sometimes sudo doesn't ask us for a password because he remembers us. How does he remember us and how does he identifie...
CVE-2025-29630
Gardyn Home Kit Firmware allows a remote attacker with the corresponding ssh private key to achieve remote root access...
MGASA-2025-0213 Updated sudo packages fix security vulnerabilities
CVE-2025-32462 - Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines CVE-2025-32463 - Sudo before 1.9.17p1 allows local users to obtain root access because...
Updated sudo packages fix security vulnerabilities
CVE-2025-32462 - Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines CVE-2025-32463 - Sudo before 1.9.17p1 allows local users to obtain root access because...
CVE-2025-29630
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue; there is no indication that an applicable SSH private key has ever been compromised. Notes: none...
CVE-2017-20198
The Marathon UI in DC/OS 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers. Due to improper restriction of volume mount configurations, attackers can deploy a container that mounts the host's root filesystem / with read/write privileges. When using a malicious Docker image,...
NewStart CGSL MAIN 7.02 : libblockdev Vulnerability (NS-SA-2025-0117)
The remote NewStart CGSL host, running version MAIN 7.02, has libblockdev packages installed that are affected by a vulnerability: - A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the allowactive setting in Polkit permits a physically present user to take...
CVE-2025-29630
...
PT-2025-31211 · Undefined · Undefined
Sitecore Experience Platform XP prior to 8.0 Initial Release rev. 141212 and Content Management System CMS prior to 7.2 Update-3 rev. 141226 and prior to 7.5 Update-1 rev. 150130 contain a vulnerability that may allow an attacker to download files under the web root of the site when the name of t...
编号撤回
Gardyn 4 is a home vertical hydroponic growing system from Gardyn USA. A security vulnerability exists in Gardyn 4, which originates from a remote attacker being able to gain root access to an affected device via the corresponding ssh private key...
NewStart CGSL MAIN 7.02 : cups Multiple Vulnerabilities (NS-SA-2025-0113)
The remote NewStart CGSL host, running version MAIN 7.02, has cups packages installed that are affected by multiple vulnerabilities: - Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow a...
CVE-2025-41240 Mounted Kubernetes Secrets under a predictable path located within the web server document root
Three Bitnami Helm charts mount Kubernetes Secrets under a predictable path /opt/bitnami//secrets that is located within the web server document root. In affected versions, this can lead to unauthenticated access to sensitive credentials via HTTP/S. A remote attacker could retrieve these secrets ...
The vulnerability of Cloudflare WARP VPN service for the macOS operating system, related to insecure privilege management. Exploiting this vulnerability can allow attackers to elevate their privileges to the root level.
The vulnerability of Cloudflare WARP VPN service for macOS relates to insecure management of privileges. Exploiting this vulnerability could allow an attacker to elevate their privileges to the root level...
CVE-2016-15045
A local privilege escalation vulnerability exists in lastore-daemon, the system package manager daemon used in Deepin Linux developed by Wuhan Deepin Technology Co., Ltd.. In versions 0.9.53-1 Deepin 15.5 and 0.9.66-1 Deepin 15.7, the D-Bus configuration permits any user in the sudo group to invo...
CVE-2025-53882
A Reliance on Untrusted Inputs in a Security Decision vulnerability in the logrotate configuration for openSUSE mailman3 package allows the mailman user to sent SIGHUP to arbitrary processes. This issue affects openSUSE Tumbleweed: from ? before 3.3.10-2.1...
CVE-2025-46116
An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where an authenticated attacker can disable the passphrase requirement for a hidden CLI command !v54! via a management API call and then invoke it t...
PT-2025-30622 · Undefined · Undefined
🚨 BREAKING: SUSE releases CRITICAL kernel patch CVE-2025-02470 | CVSS 9.1. Impact: Root access via netfilter UA Affects: Kernels 5.15-6.5 Action: zypper patch --cve=CVE-2025-02470 Read more: 👉 https://t.co/Iyqyhf0Cfc https://t.co/qRWwdxp2tj...
Cisco Confirms Active Exploits Targeting ISE Flaws Enabling Unauthenticated Root Access
Cisco on Monday updated its advisory of a set of recently disclosed security flaws in Identity Services Engine ISE and ISE Passive Identity Connector ISE-PIC to acknowledge active exploitation. "In July 2025, the Cisco PSIRT Product Security Incident Response Team, became aware of attempted...
Cisco Confirms Active Exploits Targeting ISE Flaws Enabling Unauthenticated Root Access
Cisco on Monday updated its advisory of a set of recently disclosed security flaws in Identity Services Engine ISE and ISE Passive Identity Connector ISE-PIC to acknowledge active exploitation. "In July 2025, the Cisco PSIRT Product Security Incident Response Team, became aware of attempted...