OPENSUSE-SU-2024:11491-1 vagrant-2.2.18-1.3 on GA media

These are all security issues fixed in the vagrant-2.2.18-1.3 package on the GA media of openSUSE Tumbleweed...

Exploit for CVE-2022-21907

CVE-2022-21907 Vulnerability in HTTP Protocol Stack Enabling R...

Kali Linux 2023.4 - Penetration Testing and Ethical Hacking Linux Distribution

Time for another Kali Linux release! – Kali Linux 2023.4. This release has various impressive updates. The summary of the changelog since the 2023.3 release from August is: Cloud ARM64 - Now marketplaces on Amazon AWS and Microsoft Azure have ARM64 option Vagrant Hyper-V - Our Vagrant offering...

GHSA-47XW-VW6M-W9FQ HashiCorp Vagrant Insecure Operation on Windows Junction / Mount Point vulnerability

HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0...

HashiCorp Vagrant Insecure Operation on Windows Junction / Mount Point vulnerability

HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0...

CVE-2023-5834

HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0...

Design/Logic Flaw

HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0...

CVE-2023-5834 Vagrant’s Windows Installer Allowed Directory Junction Write

HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0...

CVE-2023-5834

HashiCorp Vagrant Windows installer vulnerability CVE-2023-5834: the installer targeted a custom, non-protected path that could be junctioned, enabling unauthorized write to the file system. Root cause: directory junction/write risk in the Windows installer. Affected product/component: HashiCorp ...

CVE-2023-5834 Vagrant’s Windows Installer Allowed Directory Junction Write

HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0...

CVE-2023-5834 Vagrant’s Windows Installer Allowed Directory Junction Write

HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0...

Vagrant’s Windows Installer Allowed Directory Junction Write

Summary The Vagrant Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. This vulnerability, CVE-2023-5834, was fixed in Vagrant 2.4.0. Background Vagrant is distributed in a range of...

Vagrant Security Vulnerabilities

Vagrant is a command line utility for managing the lifecycle of virtual machines. Isolates dependencies and their configurations in a single disposable and consistent environment. A security vulnerability exists in HashiCorp Vagrant versions prior to 2.4.0 that stems from the presence of...

Exploit for CVE-2022-30190

FOLLINA-CVE-2022-30190 Implementation of FOLLINA-CVE-2022-3019...

Vagrant 安全漏洞

Vagrant is a command line utility for managing the lifecycle of virtual machines. Isolates dependencies and their configurations in a single disposable and consistent environment. Vagrant has a security vulnerability that stems from the boxAdd function not being cleaned up correctly...

Exploit for Double Free in Linux Linux_Kernel

CVE-2022-2588 Code adapted for one cpu, and with a vagrant fil...

Metasploit Weekly Wrap-UP

GLPI htmLawed PHP Command Injection Our very own bwatters-r7 wrote a module for an unauthenticated PHP command injection vulnerability that exists in various versions of GLPI. The vulnerability is due to a third-party vendor test script being present in default installations. A POST request to...

Vagrant Synced Folder Vagrantfile Breakout Exploit

This Metasploit module exploits a default Vagrant synced folder shared folder to append a Ruby payload to the Vagrant project Vagrantfile config file. By default, unless a Vagrant project explicitly disables shared folders, Vagrant mounts the project directory on the host as a writable vagrant...

Vagrant Synced Folder Vagrantfile Breakout

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Vagrant Synced Folder Vagrantfile Breakout', 'Description' = %q This module exploits a default Vagrant synced folder shared folder to append a Ru...

An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation non-privileged users on the host can leverage a wildcard in the sudoers configuration to execute arbitrary commands as root.

...