Amazon Linux 2 : amazon-ssm-agent (ALAS-2022-1807)

The version of amazon-ssm-agent installed on the remote host is prior to 3.1.1575.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1807 advisory. A buffer overflow flaw was found in Golang's library encoding/pem. This flaw allows an attacker to use a large PEM...

The vulnerability of the amazon-ssm-agent software, related to incorrect default permissions, allows attackers to create files with arbitrary extensions and elevate their privileges to root.

The vulnerability of the amazon-ssm-agent software is related to incorrect default permissions. Exploiting this vulnerability allows an attacker to create a file with any desired extension and increase their privileges to root...

CVE-2022-20808

CVE-2022-20808 affects Cisco Smart Software Manager On-Prem (SSM On-Prem). The issue is a DoS caused by incorrect handling of multiple simultaneous device registrations, exploitable by an authenticated remote attacker sending multiple registration requests. The impact is an affected device experi...

openSUSE: Security Advisory for amazon-ssm-agent (SUSE-SU-2022:1510-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE-SU-2022:1510-1 Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issues: - CVE-2022-29527: Fixed unsafe file creation mode of ssm-agent-users sudoer file bsc1196556. Update to version 3.1.1260.0...

SUSE: Security Advisory (SUSE-SU-2022:1510-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-29527

Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a world-writable sudoers file, which allows local attackers to inject Sudo rules and escalate privileges to root. This occurs in certain situations involving a race condition...

CVE-2022-29527

Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a world-writable sudoers file, which allows local attackers to inject Sudo rules and escalate privileges to root. This occurs in certain situations involving a race condition...

CVE-2022-29527

The CVE-2022-29527 issue affects Amazon AWS amazon-ssm-agent up to version 3.1.1207.x (i.e., before 3.1.1208.0). The vulnerability arises when the agent creates a world-writable sudoers file, enabling local attackers to inject sudo rules and escalate to root. The root cause is tied to a race cond...

CVE-2022-29527

Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a world-writable sudoers file, which allows local attackers to inject Sudo rules and escalate privileges to root. This occurs in certain situations involving a race condition...

Amazon AWS 安全漏洞

Amazon AWS is a cloud computing platform from the U.S.-based Amazon.com that provides a range of services including information technology infrastructure and applications, such as storage, databases, computing, machine learning, and more, to individuals, businesses, and governments. A security...

Roothub SQL Injection Vulnerability

Roothub is a forum system developed using SSM and MySQL.Roothub is vulnerable to SQL injection, which stems from the lack of validation of external input SQL statements in the s parameter of the Topics Counting feature, and can be exploited by attackers to execute illegal SQL commands to steal...

Roothub directory traversal vulnerability

Roothub is a forum system developed using SSM and MySQL. version 2.6.0 of Roothub is vulnerable to a directory traversal vulnerability that stems from a failure to properly filter resource or file paths in the file cn/roothub/store/FileSystemStorageService in the function store in the function...

Uscat 跨站脚本漏洞

Uscat is a forum system based on Javaex + Ssm development. A cross-site scripting vulnerability exists in uscat, which stems from an input box via statistical code that is susceptible to cross-site scripting XSS attacks...

tough-kms (>=0.1.0, <=0.3.3), tough-ssm (>=0.1.0, <=0.6.3) +1 more potentially affected by CVE-2021-41149 via tough (>=0.1.0, <=0.11.3)

tough CARGO version =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.6.4 Source cves: CVE-2021-41149 Source advisory: OSV:GHSA-X3R5-Q6MJ-M485...

Authorization

A vulnerability in the web UI of Cisco Smart Software Manager On-Prem SSM On-Prem could allow an authenticated, remote attacker to elevate privileges and create, read, update, or delete records and settings in multiple functions. This vulnerability is due to insufficient authorization of the Syst...

CVE-2021-34766

The CVE-2021-34766 issue affects Cisco Smart Software Manager On-Prem (SSM On-Prem) Web UI. The root cause is insufficient authorization for System User and System Operator capabilities, allowing an authenticated remote attacker to elevate privileges and perform create/read/update/delete actions ...

CVE-2021-34766

A vulnerability in the web UI of Cisco Smart Software Manager On-Prem SSM On-Prem could allow an authenticated, remote attacker to elevate privileges and create, read, update, or delete records and settings in multiple functions. This vulnerability is due to insufficient authorization of the Syst...

tough-ssm (0.1.0), tuftool (>=0.1.0, <=0.4.0) potentially affected by CVE-2020-15093 via tough (>=0.1.0, <=0.6.0)

tough CARGO version =0.1.0, =0.1.0, =0.4.0 Source cves: CVE-2020-15093 Source advisory: OSV:GHSA-5Q2R-92F9-4M49...

CVE-2020-4895

IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a truste...