Lucene search
+L

124 matches found

Github Security Blog
Github Security Blog
added 2025/08/20 3:31 p.m.9 views

CRI-O has Potential High Memory Consumption from File Read

There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a hi...

5.7CVSS7AI score0.0024EPSS
SaveExploits0References5Affected Software1
Cvelist
Cvelist
added 2025/08/20 12:19 p.m.24 views

CVE-2025-4437 Cri-o: large /etc/passwd file may lead to denial of service

There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a hi...

5.7CVSS0.0024EPSS
SaveExploits0References2
SUSE CVE
SUSE CVE
added 2025/06/27 11:26 p.m.7 views

SUSE CVE-2025-4437

There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a hi...

5.7CVSS6.9AI score0.0024EPSS
SaveExploits0References3
Snyk
Snyk
added 2025/06/26 12:00 a.m.2 views

Allocation of Resources Without Limits or Throttling

Overview github.com/cri-o/cri-o/server is an OCI-based implementation of Kubernetes Container Runtime Interface Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the handling of the /etc/passwd file. An attacker with minimal privileges to...

7.1CVSS6.8AI score0.0024EPSS
SaveExploits0References2
AstraLinux
AstraLinux
added 2025/06/16 11:28 a.m.7 views

Astra Linux – Vulnerability in containerd-app

Containerd is an open-source container runtime. A bug was discovered in Containerd prior to versions 1.6.38, 1.7.27, and 2.0.4. In these versions, containers launched with a User set as UID:GID that exceeded the maximum 32-bit signed integer could cause an overflow condition, resulting in the...

7.8CVSS6.2AI score0.00294EPSS
SaveExploits1References3
RedhatCVE
RedhatCVE
added 2025/05/23 9:45 a.m.9 views

CVE-2024-25249

An issue in He3 App for macOS version 2.0.17, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings...

9.8CVSS8AI score0.01481EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2025/05/23 9:10 a.m.9 views

CVE-2024-56321

GoCD is a continuous deliver server. GoCD versions 18.9.0 through 24.4.0 inclusive can allow GoCD admins to abuse the backup configuration "post-backup script" feature to potentially execute arbitrary scripts on the hosting server or container as GoCD's user, rather than pre-configured scripts. I...

3.8CVSS7.2AI score0.00546EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2025/05/23 7:12 a.m.13 views

CVE-2024-35179

Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, when using RUNASUSER, the specified user and therefore, web interface admins can read arbitrary files as root. This issue affects admins who have set up to run stalwart with RUNASUSER who handed out admin credentials to t...

6.8CVSS7.5AI score0.00621EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2025/05/23 6:01 a.m.11 views

CVE-2023-28122

A local privilege escalation LPE vulnerability in UI Desktop for Windows Version 0.59.1.71 and earlier allows a malicious actor with local access to a Windows device running said application to submit arbitrary commands as SYSTEM.This vulnerability is fixed in Version 0.62.3 and later...

7.8CVSS7.1AI score0.00157EPSS
SaveExploits1References1
OSV
OSV
added 2025/03/17 10:15 p.m.13 views

AZL-58867 CVE-2024-40635 affecting package containerd2 for versions less than 2.0.0-8

containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a UID:GID larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as roo...

7.8CVSS7.1AI score0.00294EPSS
SaveExploits1References1
Positive Technologies
Positive Technologies
added 2025/02/14 12:00 a.m.20 views

PT-2025-6811 · Sick · Sick Meac300-Fnade4

Name of the Vulnerable Software and Affected Versions: SICK MEAC300-FNADE4 all versions Description: The issue allows a standard user to execute commands with administrative privileges using the run as function to start MEAC applications. This is possible because administrator credentials were...

9.9CVSS7.8AI score0.00617EPSS
SaveExploits0References15
OSV
OSV
added 2024/10/01 12:00 a.m.36 views

ASB-A-307532206

In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

7.8CVSS7.7AI score0.0146EPSS
SaveExploits17References3
Positive Technologies
Positive Technologies
added 2024/09/05 12:00 a.m.8 views

PT-2024-37491 · Malwarebytes · Malwarebytes Antimalware

Name of the Vulnerable Software and Affected Versions: Malwarebytes Antimalware affected versions not specified Description: This issue allows local attackers to escalate privileges on affected installations of Malwarebytes Antimalware. An attacker must first obtain the ability to execute...

7.8CVSS7.3AI score0.00294EPSS
SaveExploits0References6
GithubExploit
GithubExploit
added 2024/08/19 2:51 a.m.610 views

Exploit for Special Element Injection in Google Android

!python-static-badgehttps://img.shields.io/badge/Python-blue?...

7.8CVSS7.2AI score0.0146EPSS
SaveExploits17
GithubExploit
GithubExploit
added 2024/08/13 3:15 p.m.32 views

Exploit for Special Element Injection in Google Android

CVE-2024-0044 Overview CVE-2024-0044 is a vulnerabili...

7.8CVSS6AI score0.0146EPSS
SaveExploits17
GithubExploit
GithubExploit
added 2024/06/18 12:30 p.m.103 views

Exploit for Special Element Injection in Google Android

CVE 2024 0044 CVE-2024-0044, identified in the createSessionI...

7.8CVSS7.8AI score0.0146EPSS
SaveExploits17
OSV
OSV
added 2024/05/15 3:55 p.m.7 views

CVE-2024-35179 Unprivileged Stalwart Mail Server user can read files as root

Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, when using RUNASUSER, the specified user and therefore, web interface admins can read arbitrary files as root. This issue affects admins who have set up to run stalwart with RUNASUSER who handed out admin credentials to t...

6.8CVSS7.3AI score
SaveExploits0References3
CNNVD
CNNVD
added 2024/05/15 12:00 a.m.6 views

Stalwart Mail Server 安全漏洞

Stalwart Mail Server is an all-in-one mail server from Stalwart Labs. A security vulnerability exists in Stalwart Mail Server versions prior to 0.8.0, which stems from the ability of a specified user to read arbitrary files as root when using RUNASUSER...

6.8CVSS6.6AI score0.00621EPSS
SaveExploits0References2
OSV
OSV
added 2024/03/23 10:15 p.m.7 views

CVE-2024-23755

ClickUp Desktop before 3.3.77 on macOS and Windows allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode...

8.8CVSS5.8AI score0.01051EPSS
SaveExploits0References4
OSV
OSV
added 2024/02/21 8:15 p.m.8 views

CVE-2024-25249

An issue in He3 App for macOS version 2.0.17, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings...

9.8CVSS6.2AI score0.01481EPSS
SaveExploits0References3
Rows per page
Query Builder