47 matches found
CVE-2023-34241 CUPS vulnerable to use-after-free in cupsdAcceptClient()
OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data...
Temporary File Information Disclosure vulnerability in MPXJ
Impact On Unix-like operating systems not Windows or macos, MPXJ's use of File.createTempFile.. results in temporary files being created with the permissions -rw-r--r--. This means that any other user on the system can read the contents of this file. When MPXJ is reading a type of schedule file...
CVE-2022-41954 Temporary File Information Disclosure Vulnerability
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems not Windows or macos, MPXJ's use of File.createTempFile.. results in temporary files being created with the permissions -rw-r--r--. This means that any other...
Webmin Cross-Site Scripting Vulnerability (CNVD-2022-54893)
A cross-site scripting vulnerability exists in Webmin, the Webmin community's Web-based system administration tool for Unix-like operating systems, due to a lack of data validation filtering of user-supplied and output data in the Read Mail module. An attacker could use this vulnerability to crea...
Potential segfault in `localtime_r` invocations
Impact Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library...
Webmin Cross-Site Scripting Vulnerability (CNVD-2022-61348)
Webmin is a set of Web-based system administration tools for Unix-like operating systems from the Webmin community.A cross-site scripting vulnerability exists in Webmin version 1.973, which stems from the lack of filtering and escaping of user-submitted parameters for the Add User feature. An...
Webmin Cross-Site Scripting Vulnerability (CNVD-2022-61350)
Webmin is a set of Web-based system administration tools for Unix-like operating systems from the Webmin community.A cross-site scripting vulnerability exists in Webmin version 1.973, which stems from the lack of filtering and escaping of user-submitted parameters for the upload and download...
Webmin Cross-Site Scripting Vulnerability (CNVD-2022-61347)
Webmin is a set of Web-based system administration tools for Unix-like operating systems from the Webmin community.A cross-site scripting vulnerability exists in Webmin version 1.973, which stems from a lack of filtering and escaping of user-submitted parameters in the file management...
Webmin Cross-Site Scripting Vulnerability (CNVD-2022-61345)
Webmin is the Webmin community's set of Web-based system management tools for Unix-like operating systems. version 1.973 of Webmin contains a cross-site scripting vulnerability that stems from a lack of filtering and escaping in the scheduled Cron jobs feature. An attacker could use this...
Webmin Cross-site Request Forgery Vulnerability (CNVD-2022-61344)
Webmin is a set of Web-based system administration tools for Unix-like operating systems from the Webmin community.Webmin version 1.973 is vulnerable to cross-site request forgery, which stems from the lack of token validation for cross-site request forgery in the scheduled Cron job function. An...
Exploit for Out-of-bounds Write in Polkit_Project Polkit
pkexec-exploit Local Privilege Escalation in polkit's pkexec...
ALBA-2021:4533 ibus bug fix update
The Intelligent Input Bus IBus is an input method framework for multilingual input in Unix-like operating systems. Bug fix: Previously, in GNOME Wayland desktop in AlmaLinux 8.5, the IBus emoji candidate pop-up was used with IBus UI and the selected candidate could not inserted into the target...
Vulnerability Spotlight: Information disclosure vulnerability in the Linux Kernel
Lilith and Claudio Bozzato of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw. Cisco Talos recently discovered an information disclosure vulnerability in the Linux Kernel. The Linux Kernel is the free and open-source core of Unix-like operating systems.... This is only the beginnin...
Webmin Input Validation Error Vulnerability
Webmin is the Webmin community's set of Web-based system administration tools for Unix-like operating systems. An input validation error vulnerability exists in Webmin version 1.962, which stems from miniserv.pl incorrectly handling special characters in the query parameters of a CGI program, and...
CVE-2020-26235: NULL Pointer Dereference
In Rust time crate from version 0.2.7 and before version 0.2.23, unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires the user to set any environment variable in a different thread than the affected functions. The affected...
Potential segfault in `localtime_r` invocations
Impact Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library...
Critical Exim Flaw Opens Servers to Remote Code Execution
A patch has been issued for a critical flaw in the Exim email server software, which could potentially open Exim-based servers up to denial of service or remote code execution attacks. Exim, which is free software used on Unix-like operating systems including Linux or Mac OSX, serves as a mail...
Shining a Light on a New Technique for Stealth Persistence
Red teamers like myself and my team are driven by a desire to out-innovate the bad guys – to help the good guys. We study their methods, strive to think like they do, work to better understand attacker techniques and test our mettle against the spectrum of technologies in use today to find new wa...
Exim SMTP listener base64d function one-character buffer overflow
Added: 05/16/2018 CVE: CVE-2018-6789 BID: 103049 Background Exim is a mail transfer agent used on Unix-like operating systems. Problem Exim 5.90 and earlier are vulnerable to a one-character buffer overflow in the base64d function in the SMTP listener. Resolution Upgrade to Exim 4.90.1 or higher,...
