10449 matches found
Sudo sudoedit Privilege Escalation
The vulnerability of the sudoedit function in the system administration program Sudo is related to errors in processing additional arguments in the environment variables. Exploiting this vulnerability allows a malicious actor to increase their privileges remotely...
CVE-2022-45925
An issue was discovered in OpenText Content Suite Platform 22.1 16.2.19.1803. The action xmlexport accepts the parameter requestContext. If this parameter is present, the response includes most of the HTTP headers sent to the server and some of the CGI variables like remoteadde and servername,...
Information disclosure
An issue was discovered in OpenText Content Suite Platform 22.1 16.2.19.1803. The action xmlexport accepts the parameter requestContext. If this parameter is present, the response includes most of the HTTP headers sent to the server and some of the CGI variables like remoteadde and servername,...
ALPINE-CVE-2023-22809
In Sudo before 1.9.12p2, the sudoedit aka -e feature mishandles extra arguments passed in the user-provided environment variables SUDOEDITOR, VISUAL, and EDITOR, allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected...
DEBIAN-CVE-2023-22809
In Sudo before 1.9.12p2, the sudoedit aka -e feature mishandles extra arguments passed in the user-provided environment variables SUDOEDITOR, VISUAL, and EDITOR, allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected...
AZL-13030 CVE-2023-22809 affecting package sudo for versions less than 1.9.12p2-1
In Sudo before 1.9.12p2, the sudoedit aka -e feature mishandles extra arguments passed in the user-provided environment variables SUDOEDITOR, VISUAL, and EDITOR, allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected...
Design/Logic Flaw
In Sudo before 1.9.12p2, the sudoedit aka -e feature mishandles extra arguments passed in the user-provided environment variables SUDOEDITOR, VISUAL, and EDITOR, allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected...
CVE-2022-45925: Exposure of Sensitive Information to an Unauthorized Actor
An issue was discovered in OpenText Content Suite Platform 22.1 16.2.19.1803. The action xmlexport accepts the parameter requestContext. If this parameter is present, the response includes most of the HTTP headers sent to the server and some of the CGI variables like remoteadde and servername,...
CVE-2023-22809: Improper Privilege Management
In Sudo before 1.9.12p2, the sudoedit aka -e feature mishandles extra arguments passed in the user-provided environment variables SUDOEDITOR, VISUAL, and EDITOR, allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected...
Sudoedit Extra Arguments Priv Esc
This exploit takes advantage of a vulnerability in sudoedit, part of the sudo package. The sudoedit aka sudo -e feature mishandles extra arguments passed in the user-provided environment variables SUDOEDITOR, VISUAL, and EDITOR, allowing a local attacker to append arbitrary entries to the list of...
CVE-2023-22809
In Sudo before 1.9.12p2, the sudoedit aka -e feature mishandles extra arguments passed in the user-provided environment variables SUDOEDITOR, VISUAL, and EDITOR, allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected...
Sudo security vulnerabilities
Sudo is a program used on Unix-like systems that allows users to execute commands with special privileges in a secure manner. A security vulnerability in Sudo before 1.9.12p2 stems from the sudoedit a.k.a. -e function mishandling additional arguments passed in user-supplied environment variables...
PT-2023-1077
Name of the Vulnerable Software and Affected Versions Sudo versions 1.8.0 through 1.9.12p1 Description The issue is related to the sudoedit feature in Sudo, which mishandles extra arguments passed in user-provided environment variables, such as SUDO EDITOR, VISUAL, and EDITOR. This allows a local...
CVE-2023-22809
In Sudo before 1.9.12p2, the sudoedit aka -e feature mishandles extra arguments passed in the user-provided environment variables SUDOEDITOR, VISUAL, and EDITOR, allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected...
CVE-2023-22809
The sudo utility (versions 1.8.0 through 1.9.12.p1) contains a vulnerability in the sudoedit (aka -e) feature. A local attacker with permissions to use sudoedit can exploit the way the application mishandles extra arguments passed via user-provided environment variables, such as SUDO_EDITOR , VIS...
UBUNTU-CVE-2023-22809
In Sudo before 1.9.12p2, the sudoedit aka -e feature mishandles extra arguments passed in the user-provided environment variables SUDOEDITOR, VISUAL, and EDITOR, allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected...
Malware Attack on CircleCI Engineer's Laptop Leads to Recent Security Incident
DevOps platform CircleCI on Friday disclosed that unidentified threat actors compromised an employee's laptop and leveraged malware to steal their two-factor authentication-backed credentials to breach the company's systems and data last month. The CI/CD service CircleCI said the "sophisticated...
Information Disclosure
github.com/hashicorp/nomad is vulnerable to information disclosure. The vulnerability exists because the consul-template in templateRunner of template. go always falls back to host process environment variables when the key isn't a task in env var1, allowing an attacker to gain sensitive...
EulerOS 2.0 SP9 : golang (EulerOS-SA-2023-1100)
According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amoun...
EulerOS 2.0 SP9 : golang (EulerOS-SA-2023-1124)
According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amoun...