18898 matches found
CVE-2024-29150
An issue was discovered in Alcatel-Lucent ALE NOE deskphones through 86x8NOE-R300.1.40.12.4180 and SIP deskphones through 86x8SIP-R200.1.01.10.728. Because of improper privilege management, an authenticated attacker is able to create symlinks to sensitive and protected data in locations that are...
Oracle Linux 9 : pcp (ELSA-2024-2213)
The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-2213 advisory. 6.2.0-1.0.1 - Fixed libpcp derived metric issue for ol9 Orabug: 36538820 6.2.0-1 - Rebase to latest stable version of PCP RHEL-2317 6.1.1-4 - Fix pcp-ss1 handli...
CVE-2023-37244
The affected AutomationManager.AgentService.exe application contains a TOCTOU race condition vulnerability that allows standard users to create a pseudo-symlink at C:\ProgramData\N-Able Technologies\AutomationManager\Temp, which could be leveraged by an attacker to manipulate the process into...
CVE-2023-37244
The affected AutomationManager.AgentService.exe application contains a TOCTOU race condition vulnerability that allows standard users to create a pseudo-symlink at C:\ProgramData\N-Able Technologies\AutomationManager\Temp, which could be leveraged by an attacker to manipulate the process into...
CVE-2023-37244 Privilege escalation in N-Able's AutomationManagerAgent
The affected AutomationManager.AgentService.exe application contains a TOCTOU race condition vulnerability that allows standard users to create a pseudo-symlink at C:\ProgramData\N-Able Technologies\AutomationManager\Temp, which could be leveraged by an attacker to manipulate the process into...
CVE-2023-37244
The CVE-2023-37244 entry concerns AutomationManager.AgentService.exe and describes a TOCTOU race condition that lets standard users create a pseudo-symlink at C:\ProgramData\N-Able Technologies\AutomationManager\Temp. This could enable an attacker to manipulate the process into performing arbitra...
Symlink Attack
Salt is vulnerable to Symlink attacks. The vulnerability is due to insecure creation of temporary files in seed.py ,salt-ssh, or salt-cloud, which allows a local attacker to exploit this by creating symbolic links to overwrite arbitrary files with elevated privileges...
CVE-2024-26972
Removed by vendor...
CVE-2024-26972
CVE-2024-26972 : Linux kernel UBIFS implementation issue in ubifs_symlink could leak inode->i_link in error paths when symlink encryption is involved. The description in connected advisories states the issue arises after marking an inode bad and calling iput(), if inode->i_link was initiali...
pcp: unsafe use of directories allows pcp to root privilege escalation
A vulnerability has been identified in the Performance Co-Pilot PCP package, stemming from the mixed privilege levels utilized by systemd services associated with PCP. While certain services operate within the confines of limited PCP user/group privileges, others are granted full root privileges...
SUSE CVE-2022-48682
In deletefiles in FDUPES before 2.2.0, a TOCTOU race condition allows arbitrary file deletion via a symlink...
RHEL 9 : pcp (RHSA-2024:2213)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2213 advisory. Performance Co-Pilot PCP is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance...
Important: Red Hat Security Advisory: container-tools:rhel8 security and bug fix update
An update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Security team has rated the vulnerability impact of the fixed issues as Important. The container-tools module contains tools for working with containers, notably podman,...
podman: Symlink error leads to information disclosure
A vulnerability was found in buildah and podman. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure...
RHEL 6 / 7 : rh-ruby24-ruby (RHSA-2019:1150)
The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1150 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system...
Exploit for Path Traversal in Aiohttp
poc-cve-2024-23334 This repository contains a proof of concept...
RHEL 7 : rh-ruby25-ruby (RHSA-2019:1148)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1148 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system...
CVE-2022-48682
In deletefiles in FDUPES before 2.2.0, a TOCTOU race condition allows arbitrary file deletion via a symlink...
