CVE-2019-19882

shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing...

PT-2019-15986

Name of the Vulnerable Software and Affected Versions shadow version 4.8 Description The issue allows local users to obtain root access due to misconfigured setuid programs. This specifically affects shadow 4.8 when compiled with --with-libpam but without --disable-account-tools-setuid and withou...

PT-2019-20099

Name of the Vulnerable Software and Affected Versions util-linux affected versions not specified shadow affected versions not specified Description The issue involves multiple problems with util-linux and shadow, including ignored PATH settings in /etc/default/su, outdated pam files, and incorrec...

SUSE-SU-2019:2307-1 Security update for util-linux and shadow

This update for util-linux and shadow fixes the following issues: util-linux: - Fixed an issue where PATH settings in /etc/default/su being ignored bsc1121197 - Prevent outdated pam files bsc1082293. - De-duplicate fstrim -A properly bsc1127701. - Do not trim read-only volumes bsc1106214. -...

PT-2019-20195

Name of the Vulnerable Software and Affected Versions util-linux affected versions not specified shadow affected versions not specified Description The issue involves multiple problems with util-linux and shadow, including ignored PATH settings in /etc/default/su, outdated pam files, and a segfau...

openSUSE Security Update : shadow (openSUSE-2019-721)

This update for shadow fixes the following security issue : - CVE-2018-16588: Prevent useradd from creating intermediate directories with mode 0777 bsc1106914 This update was imported from the SUSE:SLE-15:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Linux: Disable account when password expires

A user without activity can be locked after a specific period of time. When creating a new user with SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

SUSE SLED15 / SLES15 Security Update : shadow (SUSE-SU-2018:2834-1)

This update for shadow fixes the following security issue : Prevent useradd from creating intermediate directories with mode 0777 bsc1106914 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

SUSE shadow account management tool Privilege Escalation

The vulnerability of the useradd function useradd.c in the SUSE shadow account management tool is related to access control errors. Exploiting this vulnerability can allow an attacker to increase their privileges...

Cross site request forgery (csrf)

sikcms 1.1 has CSRF via admin.php?m=Admin&c=Users&a=userAdd to add an administrator account...

CVE-2018-19561

sikcms 1.1 has CSRF via admin.php?m=Admin&c=Users&a=userAdd to add an administrator account...

CVE-2018-19557

An issue was discovered in arcms through 2018-03-19. No authentication is required for index/main, user/useradd, or img/images...

CVE-2018-19557: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in arcms through 2018-03-19. No authentication is required for index/main, user/useradd, or img/images...

PT-2018-15006

Name of the Vulnerable Software and Affected Versions sikcms version 1.1 Description The issue allows for CSRF via the "admin.php?m=Admin&c=Users&a=userAdd" endpoint to add an administrator account. Recommendations For version 1.1, as a temporary workaround, consider disabling access to the...

PT-2018-15002

Name of the Vulnerable Software and Affected Versions arcms through 2018-03-19 Description An issue was discovered where no authentication is required for certain endpoints, including "index/main", "user/useradd", and "img/images". Recommendations For arcms through 2018-03-19, consider restrictin...

sikcms Cross-Site Request Forgery Vulnerability

sikcms Cisco CMS is a backend content management system. A cross-site request forgery vulnerability exists in sikcms version 1.1. A remote attacker can add an administrator account with the help of the /sikcms/admin.php?m=Admin&c=Users&a=userAdd URL...

Micro Focus SUSE shadow package elevation of privilege vulnerability

The Micro Focus SUSE shadow package is an encryption-enabled software package for use on Linux systems from Micro Focus, a British company. A security vulnerability exists in the SUSE useradd.c code for useradd in the Micro Focus SUSE shadow package. A local attacker could exploit the vulnerabili...

openSUSE Security Update : shadow (openSUSE-2018-1055)

This update for shadow fixes the following security issue : - CVE-2018-16588: Prevent useradd from creating intermediate directories with mode 0777 bsc1106914 This update was imported from the SUSE:SLE-12-SP2:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

CVE-2018-16588

CVE-2018-16588 affects the SUSE shadow package’s useradd.c code. Local attackers could exploit it by triggering creation of non-existing intermediate directories with world-writable mode 0777 during user creation, enabling privilege escalation. The impact is local, with high secrecy/ integrity/ a...

Security update for shadow (moderate)

This update for shadow fixes the following security issue: - CVE-2018-16588: Prevent useradd from creating intermediate directories with mode 0777 bsc1106914 This update was imported from the SUSE:SLE-12-SP2:Update update project...